I am not sure this is at all easy to do right.

ansible runs as root, so it would need to be some playbook that took project name as a arugment, and then there's no way to tell if that person is the app owner or not... I guess the chance is small that someone would remove someone elses app by mistake, but then I think just doing this manually is fine given how infrequently it comes up...

I am not sure this is at all easy to do right.
ansible runs as root, so it would need to be some playbook that took project name as a arugment, and then there's no way to tell if that person is the app owner or not...

we do have that information, though? For example here is the list for coreos-koji-tagger:
https://infrastructure.fedoraproject.org/cgit/ansible.git/tree/playbooks/openshift-apps/coreos-koji-tagger.yml?id=ec2028fcf14a934a2294d99181b75c47943f5e24#n15

Is the issue just that the information i just linked is hard to get?

I am not sure we have information about who is running the playbook via rbac-playbook. Ansible sees 'root'.

I am not sure we have information about who is running the playbook via rbac-playbook. Ansible sees 'root'.

interesting. so I guess rbac-playbook determines if the user can run it and then runs the playbook as root? Could rbac-playbook set an ansible variable or an environment variable that we could then use inside ansible?

Is the source code for rbac-playbook anywhere?

@dustymabe For deleting objects, you can use the openshift/delete-object role you pointed out.

An example invocation would be:

- role: openshift/delete-object
  app: my-cool-openshift-project
  objecttype: route
  objectname: myroute

When you then run the playbook, the object will be removed from openshift.
This will work for any app you specify, and the only check here that you don't delete someone else's apps are that you need to commit this to the ansible repo, which means that if you abuse it, this gets publicly announced.

so you're saying if I want to delete my project I need to create a new playbook (call it coreos-koji-tagger-delete.yml that has:

- role: openshift/delete-object
  app: coreos-koji-tagger
  objecttype: project
  objectname: coreos-koji-tagger

and then call sudo rbac-playbook openshift-apps/coreos-koji-tagger-delete.yml ?

Wouldn't someone need to give me permission to run that playbook?

so you're saying if I want to delete my project I need to create a new playbook (call it coreos-koji-tagger-delete.yml that has:

I think this would be easier if you just add the snippet to an existing playbook
that you already have permission to run.
And it's a one-time thing anyway right?

so add the snippet, run the playbook, delete the snippet? Seems kind of wrong to me. I'd prefer the other approach I think.

I came up with a half solution to this: https://infrastructure.fedoraproject.org/cgit/ansible.git/commit/?id=af7dbe7