RenderMailTemplate: change endpoint permission

[VoigtS]

the smoke-test user that is used in the pipeline only has show_basic permissions, which conflicts with this endpoint. Instead of granting the user more permissions, the endpoint permission gets changed instead.

[wagnerd3]

I just realized that cluster:show_basic is used in the old world to give simple project members access to cluster level access and not just to cloud_ roles.

A nicer way would be to pick up the permission scheme for the v2 API and introduce a policy for v2:cluster:admin and define this to match also the limes-validation user we have for this smoke testing. Let's discuss offline.

[VoigtS]

the policy now uses the v2:cluster:validation from the proposal: sapcc/helm-charts#11513

[wagnerd3]

We need to wait for the chart PR before merging.

[majewsky]

please adjust docs/example-policy.json to document this policy

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/sapcc/limes/internal/api	78.47% (ø)

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/sapcc/limes/internal/api/mail.go	89.19% (ø)	259	231	28

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/sapcc/limes/internal/api/mail_test.go

[majewsky]

ok