Control API Architecture

[tobru]

Checklist

• Try to isolate changes into separate PRs (to build a better changelog).
• Categorize the PR by setting a good title and adding one of the labels:
  change, decision, requirement/quality, requirement/functional, dependency
  as they show up in the changelog

[corvus-ch]

The sync between Keycloak and an APPUiO Cloud Zone is based on the user name. This architecture now uses the users UUID. While this solves the issue of namespace name uniquenss (no need to prefix), it introduces a cognitive disconect for the users (one system uses username the other uses UUID). I would prefer to stick with username and accept the need for prefexing.

[ccremer]

The sync between Keycloak and an APPUiO Cloud Zone is based on the user name. This architecture now uses the users UUID. While this solves the issue of namespace name uniquenss (no need to prefix), it introduces a cognitive disconect for the users (one system uses username the other uses UUID). I would prefer to stick with username and accept the need for prefexing.

If we use the username in a metadata.name for namespaces, it will impose a limit to what usernames are possible. We would need to verify that usernames are matching a-z and no certain special characters (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#dns-label-names). We couldn't use email addresses as usernames for example since they contain @ (depending on a brokered IdP this can be a case). However, in https://kb.vshn.ch/appuio-cloud/references/quality-requirements/usability/user-arbitrary-name.html we defined that users can choose an arbitrary name.

As ugly as it is, we can't just take the username verbatim and prefix it.

[corvus-ch]

I object against having two conflicting documentations in paralell. While it seems more complicated, I understand and agree with user being a global resource with all those roles and rolebindings (does this work as expected/was this tested?).

[tobru]

I object against having two conflicting documentations in paralell.

As written in the internal chat, the idea is to delete the page which doesn't reflect our proposal. It's only here to have both options during discussions. Before it gets merged, a cleanup will be done.

While it seems more complicated, I understand and agree with user being a global resource with all those roles and rolebindings (does this work as expected/was this tested?).

Testing currently ongoing, but by-the-docs it should ™️ work.