Fixes session active check with datacenter scoped TKG admin account

pkg/session/error.go

@@ -19,6 +19,9 @@ package session
 import (
 	"fmt"
 	"strings"
+
+	"github.com/vmware/govmomi/vim25/soap"
+	"github.com/vmware/govmomi/vim25/types"
 )
 
 const (
@@ -37,3 +40,14 @@ func (e unidentifiedVCenterVersion) Error() string {
 func IsUnidentifiedVCenterVersion(err error) bool {
 	return strings.HasPrefix(err.Error(), errString)
 }
+
+func HasNoPermission(err error) bool {
+	if soap.IsSoapFault(err) {
+		soapError := soap.ToSoapFault(err)
+		if _, ok := soapError.VimFault().(types.NoPermission); ok {
+			return true
+		}
+	}
+
+	return false
+}

pkg/session/session.go

@@ -37,6 +37,7 @@ import (
 	"github.com/vmware/govmomi/vapi/tags"
 	"github.com/vmware/govmomi/vim25"
 	"github.com/vmware/govmomi/vim25/methods"
+	"github.com/vmware/govmomi/vim25/mo"
 	"github.com/vmware/govmomi/vim25/soap"
 	ctrl "sigs.k8s.io/controller-runtime"
 
@@ -133,7 +134,18 @@ func GetOrCreate(ctx context.Context, params *Params) (*Session, error) {
 
 		vimSessionActive, err := s.SessionManager.SessionIsActive(ctx)
 		if err != nil {
-			logger.Error(err, "unable to check if vim session is active")
+			if HasNoPermission(err) && s.datacenter != nil {
+				var dc mo.Datacenter
+				err = s.Client.RetrieveOne(ctx, s.datacenter.Reference(), nil, &dc)
+				vimSessionActive = err == nil
+				if vimSessionActive {
+					logger.Info("vim session is active as the datacenter is found")
+				}
+			}
+
+			if err != nil {
+				logger.Error(err, "unable to check if vim session is active")
+			}
 		}
 
 		tagManagerSession, err := s.TagManager.Session(ctx)