miki3421 opened a new issue, #215:
URL: https://github.com/apache/openserverless/issues/215
## Feature request
Define explicit and safe lifecycle semantics for tenant removal. Today,
deleting a user mixes identity deprovisioning with partial backend cleanup,
while the command name suggests that all tenant data is removed.
## Current behavior
Depending on the task/operator version, `ops admin deleteuser <username>`
deletes the `WhiskUser` and then attempts local CLI config cleanup. The
operator cleanup is not an atomic, verified tenant purge:
- the OpenWhisk subject/auth document is removed, while tenant entities such
as actions can remain;
- Redis cleanup removes the ACL user, while keys under the tenant prefix can
remain;
- cleanup is attempted for other enabled services, but the command does not
expose a reliable per-backend postcondition report;
- recreating a tenant with the same namespace reuses the same logical
identifiers and can make surviving data visible again.
In one observed environment, after delete and recreate, dozens of OpenWhisk
actions and more than 1,000 tenant-prefixed Redis keys were still present. Only
aggregate counts were inspected; no tenant data content was read.
This makes it difficult for an administrator to know whether the requested
operation means "revoke access but preserve data" or "irreversibly erase the
tenant".
## Proposed command model
Introduce two distinct operations:
1. `ops admin deprovisionuser <username>`
- revoke credentials, routes and service identities;
- preserve tenant data for recovery or retention;
- report which resources remain.
2. `ops admin purgeuser <username> --confirm=<username>`
- irreversibly delete all resources owned by the tenant;
- verify every postcondition before reporting success;
- return non-zero when residual resources remain.
For compatibility, `deleteuser` could remain as an alias for deprovisioning
with a clear deprecation/message, rather than silently changing its destructive
semantics.
The proposed `purgeuser` command does **not** currently exist.
## Purge contract
A purge should cover enabled tenant resources, including:
- OpenWhisk packages, actions, triggers, rules and applicable activation
data;
- Redis keys selected by the exact authorized tenant prefix, followed by ACL
user removal;
- object storage buckets, objects and service user;
- MongoDB/FerretDB, PostgreSQL and Milvus tenant databases, schemas or
collections;
- generated ingress/routes, static hosting resources and operator metadata.
Custom or out-of-band resources should be discovered and reported, but not
deleted blindly.
## Safety and operability
- Add `--dry-run` to inventory affected resources without mutation.
- Require an explicit confirmation that includes the namespace name.
- Treat already-missing resources as success so retries are idempotent.
- Produce a structured per-backend summary with deleted, preserved, skipped,
failed and residual states.
- Verify postconditions for each enabled backend.
- Avoid logging credentials, secrets or the complete `WhiskUser`
specification.
- Optionally support retention/preserve flags and a pre-purge backup hook.
## Acceptance criteria
- Deprovisioning and purge have documented, unambiguous semantics.
- Recreating a deprovisioned namespace can intentionally recover preserved
data.
- Recreating a successfully purged namespace starts empty.
- Partial failures return non-zero and identify the affected
backend/resources.
- Re-running purge after partial failure completes safely.
- Dry-run and confirmation behavior have automated tests.
- Tests cover OpenWhisk entities, Redis prefixed keys and each optional data
service enabled in CI.
## Affected components
This likely spans:
- `apache/openserverless-task` admin task and CLI surface;
- `apache/openserverless-operator` `WhiskUser` reconciliation/finalization
and backend cleanup handlers;
- downstream task distributions that expose `ops admin deleteuser`.
## Environment where observed
- ops CLI: `0.9.1-2607121109.dev`
- task branch: `apache/openserverless-task:0.9.1`
- operator image:
`apache/openserverless-operator:0.1.0-incubating.2512151437`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
