COST-4764 Set lower level rbac roles when only top level are set for OpenShift cluster/node/project

[lcouzens]

Jira Ticket

COST-4764

Description

This change will fix partial matching for things like project/node filtering with a higher level rbac roles such as cluster by explicitly implying the correct lower level role accordingly.

Example:

If you restrict to a single cluster this change will set node and project role to * (Access all items beneath that cluster)

Testing

1. Checkout Main
2. run python koku/manage.py shell
3. from koku.rbac import _apply_access
4. _apply_access({'openshift.cluster': [{'operation': 'read', 'resources': ['test_cluster']}]})
5. see returned access specifically the openshift sections just have test_cluster set
6. Checkout this branch and repeat steps 2-5 above
7. See the returned access now explicitly sets the lower lover access to * for node/project

Additional testing:
Try various access settings such as node and project levels:
_apply_access({'openshift.cluster': [{'operation': 'read', 'resources': ['test_cluster']}], 'openshift.node': [{'operation': 'read', 'resources': ['test_node']}]})
_apply_access({'openshift.cluster': [{'operation': 'read', 'resources': ['test_cluster']}], 'openshift.node': [{'operation': 'read', 'resources': ['test_node']}], 'openshift.project': [{'operation': 'read', 'resources': ['test_project']}]})

really adventurous you can try these too
'openshift.node': [{'operation': 'read', 'resources': ['test_node']}]
result:
'openshift.cluster': {'read': []},
'openshift.node': {'read': ['test_node]},
'openshift.project': {'read': ['*']},

'openshift.project': [{'operation': 'read', 'resources': ['test_project']}]
result:
'openshift.cluster': {'read': []},
'openshift.node': {'read': []},
'openshift.project': {'read': ['test_project']},

Release Notes

• proposed release note

* [COST-4764](https://issues.redhat.com/browse/COST-4764) Fix Rbac issue around partial matching when filtering data

[codecov]

Codecov Report

Merging #5020 (20a2193) into main (be7d562) will decrease coverage by 0.0%.
The diff coverage is 100.0%.

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #5020     +/-   ##
=======================================
- Coverage   94.1%   94.1%   -0.0%     
=======================================
  Files        377     377             
  Lines      31230   31237      +7     
  Branches    3709    3713      +4     
=======================================
+ Hits       29390   29393      +3     
- Misses      1171    1174      +3     
- Partials     669     670      +1     

[maskarb]

What is being fixed? Should we be allowing partial matching when filtering? I don't think we should because this was explicitly disallowed with this issue:
https://issues.redhat.com/browse/COST-382

[maskarb]

lgtm!