lab/iac
1
0
Fork 0
Code Issues 11 Pull requests 3 Projects Releases Packages Wiki Activity Actions

rename capability groups to DNS-1123-safe hyphen form #21

Merged
ginjiruu merged 1 commit from rename-capability-groups-hyphens into master 2026-08-11 18:41:32 +00:00
Conversation 0 Commits 1 Files changed 3 +10 -5
ginjiruu commented 2026-08-11 18:38:15 +00:00
Owner
Copy link

Rename kanidm capability groups from group-<app>_<capability> to group-<app>-<capability> so one string serves as the kanidm group name, the k8s RoleBinding subject, and the k8s Role name.

Why: the underscore form was illegal as a k8s object name (RFC 1123 — no underscores), forcing a second name for Roles/RoleBindings (privatebin-developer vs group-privatebin_developer) and a mental translation rule per capability. With hyphens, the object names, subjects, and kanidm groups all collapse to one token.

Now is the cheap window: ADR-0006/0007 are still proposed and the groups have no members yet — a rename is delete+recreate, costless while empty. The tofu-controller will reconcile the rename on next apply; existing underscore-named groups are recreated hyphenated.

Files: kanidm/modules/dev_groups/main.tf, README.md (naming convention), CONTEXT.md (domain note).

Tracked work: prefactor for #7 (T4 k8s capability Roles) — the T4 branch's RoleBinding subjects already use the hyphen form and will match once this merges.

Rename kanidm capability groups from `group-<app>_<capability>` to `group-<app>-<capability>` so one string serves as the kanidm group name, the k8s RoleBinding subject, and the k8s Role name. **Why:** the underscore form was illegal as a k8s object name (RFC 1123 — no underscores), forcing a second name for Roles/RoleBindings (`privatebin-developer` vs `group-privatebin_developer`) and a mental translation rule per capability. With hyphens, the object names, subjects, and kanidm groups all collapse to one token. **Now is the cheap window:** ADR-0006/0007 are still `proposed` and the groups have no members yet — a rename is delete+recreate, costless while empty. The tofu-controller will reconcile the rename on next apply; existing underscore-named groups are recreated hyphenated. Files: `kanidm/modules/dev_groups/main.tf`, `README.md` (naming convention), `CONTEXT.md` (domain note). Tracked work: prefactor for #7 (T4 k8s capability Roles) — the T4 branch's RoleBinding subjects already use the hyphen form and will match once this merges.
ginjiruu merged commit 2574fdcad8 into master 2026-08-11 18:41:32 +00:00
ginjiruu deleted branch rename-capability-groups-hyphens 2026-08-11 18:41:33 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info
Waiting on reporter for more information

  
needs-triage
Maintainer needs to evaluate this issue

  
ready-for-agent
Fully specified, ready for an AFK agent

  
ready-for-human
Requires human implementation

  
wontfix
Will not be actioned

No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/iac!21
No description provided.