Blacklist error message is unhelpful

[Michael Chapman]

As noted during review here https://review.opendev.org/c/openstack/designate/+/793325/3/doc/source/admin/blacklists.rst when the user attempts to create a zone that is within a blacklist the error message doesn't let the user know what the blacklist covers.

The zone create API spec doesn't specify what is contained within the message when there is an error, so perhaps either the blacklist object ID or the regex itself could be returned.

By default the blacklist API only allows read access to system admins, so this should probably change if the user is going to be told which regex their zone has matched as part of the error.

[Dr. Jens Harbott (j-harbott)]

a) This would seem a bug of the API instead of the client, the latter can only respond with what it gets from the API.
b) In my understanding the details of the blacklist regexes are hidden from users by design, so exposing any of the information you are mentioning might undermine what some deployers consider a security feature.
Maybe a deployer can change the access permissions for the blacklist API via a different policy, but I'm not convinced that the current default behavior is wrong and would need to be changed.

[Michael Chapman (michaeltchapman)]

a) Fixed, thanks.

b) This is reasonable. How about if we put the blacklist resource ID that it has matched? That doesn't really leak anything and then if the blacklist API is opened up by the operator for reads by users they can see what's blocking them.

An extension to this could be to make an extra API call in the client when it hits that error, so that the client error is improved to showing the query where possible. This is a small performance hit, but I think in this case it would be worth it.