Feature/119 support dogu v3#120
Conversation
kahoona77
left a comment
kahoona77
left a comment
There was a problem hiding this comment.
Thanks for this PR; it looks very good 💯
I found some smaller issues and one slightly bigger issue regarding the service-accounts
| fi | ||
| done | ||
|
|
||
| EXISTING_USER_ID=$(doguctl config service_accounts/"${CONSUMER}" --default "default") |
There was a problem hiding this comment.
The service account state marker is never persisted.
The v3 hooks (sa-hook-exists.sh, sa-hook-create.sh) rely on the doguctl key service_accounts/ as the source of truth for whether a SA already exists, but the create-sa.sh/remove-sa.sh never write or remove it (in Nexus, create-sa.sh sets it and remove-sa.sh removes it).
As a result the key is always "default", so:
- exists always reports "not found" and the operator re-creates the account on every reconcile, piling up orphaned SCM users
- the rotation logic in
create-sa.shis always skipped (old account never removed on rotation).
Maybe this might be a solution:
Use a fixed name per consumer (e.g. sa-) instead of a random suffix. This makes everything idempotent via the SCM API, no doguctl marker needed:
- exists: GET /api/v2/users/sa- -> 200 = exists, 404 = not.
- create: create only on 404, otherwise no-op -> no orphaned users.
- rotate: just set a new password via PUT /api/v2/users/sa-/password, no delete+recreate.
Trade-off: changes the username scheme (use a prefix to avoid clashing with real users), but removes the duplicate-account problem.
Co-authored-by: kahoona77 <benjamin.ernst@cloudogu.com>
Co-authored-by: kahoona77 <benjamin.ernst@cloudogu.com>
Co-authored-by: kahoona77 <benjamin.ernst@cloudogu.com>
Remove todo Use correct extravolumes for gotenberg Replace nexus to scm
3 participants
Add dogu v3 support