PUT 403 on infra.namespace role

[ebilisariavgd]

Summary

When using 'namespace' role, through dispatch, I randomly get a HTTP 403 error on PUT request.

Issue Type

• Bug Report

Ansible, Collection, Private Automation Hub details

ansible --version
ansible-playbook [core 2.14.4]
  [...]
  python version = 3.9.18 [GCC 8.5.0 20210514 (Red Hat 8.5.0-20)] (/usr/bin/python3)
  jinja version = 3.1.3
  libyaml = True

ansible-galaxy collection list
infra.ah_configuration:2.0.6

Private Automation Hub version
Server version 4.9.1
Pulp Ansible Version 0.20.3
Pulp Core Version 3.28.23
Galaxy Importer 0.4.18
Ansible Automation Platform 2.4

• ansible installation method: EE

OS / ENVIRONMENT

Running through Ansible Automation Platform node-install on RHEL8, installed both AAP & PAH.

Desired Behavior

Role should be idempotent and not receive an error.

Actual Behavior

If the namespace already exists, it randomly fails on a HTTP 403 error. Same if it is the only role called by dispatch.
If said namespace is manually deleted, it is recreated successfully.
If PUT is done manually through curl with same parameters, it is 200 OK.

Failing on "Create Namespace | Wait for finish the namespace creation"

You don't have permission to PUT to /api/galaxy/v3/namespaces/XXX_system/ (HTTP 403).
File "/tmp/ansible_ah_namespace_payload_yyy/ansible_ah_namespace_payload.zip/ansible_collections/infra/ah_configuration/plugin/module_utils/ah_module.py", line 224, in make_request
    response = self.session.open(
      File "/tmp/ansible_ah.../module_utils/urls.py", line 1557, in open
         r = urllib_request
      [...]

{
  "module_args": {
    "name": "XXX_system",
    "new_name": "",
    "description": "My namespace",
    "company": "Mine",
    "avatar_url": "",
    "resources": "",
    "links": [],
    "groups": [],
    "state": "present",
    "ah_host": "my_fqdn",
    "ah_username": "service-account",
    "ah_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
    "validate_certs": false,
    "ah_path_prefix": "galaxy",
    "ah_token": null,
    "request_timeout": null,
    "email": null
  }
}

I have 4 different namespaces declared (names changed only), and others succeed while one randomly fails (they are "finished": "1").

STEPS TO REPRODUCE

• Create said namespaces (manually or with the same playbook).
• Relaunch the same playbook

---
- name: My playbook
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    ah_configuration_dispatcher_roles:
      - role: namespace
        var: ah_namespaces
        tags: namespaces
    ah_namespaces:
      - name: XXX_other3
        state: present
        description: My namespace
        company: Mine
      - name: XXX_system
        state: present
        description: My namespace
        company: Mine
      - name: XXX_other2
        state: present
        description: My namespace
        company: Mine
      - name: XXX_other1
        state: present
        description: My namespace
        company: Mine
  roles:
    - role: infra.ah_configuration_dispatch

[ebilisariavgd]

Same problem using directly 'infra.ah_configuration.namespace' role.
It seems that a 403 is returned when no change is applied, though I do not have this problem using curl 🤔