Skip to content

[EPIC] Standardize usage of Cluster credentials across providers #1273

Open
@anmazzotti

Description

@anmazzotti

This epic issue is about deprecating global credentials for provisioning, and using Cluster credentials instead.
The goal is to make provider installation easier, and to improve security standards and best practices on provisioning.

There are a few tasks to be done for each certified infra provider:

  • Implement Cluster credentials, if missing.
    Most providers already support Cluster credentials. Note that for cloud providers they typically come in 2 flavors, managed (as in passwordless) and non-managed credentials. We need the latter, so that the management Cluster can live outside the cloud provider environment.

  • Allow optional global credentials
    If the provider supports global credentials, those should be optional. For example in CAPA AWS_B64ENCODED_CREDENTIALS can already be blank. This should be default so that the user does not have to enter this variable when installing the provider.

  • Update Turtles and provider's upstream user documentation to make use of Cluster credentials
    Providers that support global credentials, often use it for their quickstart CAPI tutorial. This documentation should be updated to use Cluster credentials instead as a best practice. The same applies to Turtles documentation when consuming ClusterClasses (or those providers in any other way)

  • Update Turtles e2e tests to use Cluster credentials
    For some this can already be done in parallel (CAPA, CAPG). Tests need to ensure that the intended and recommended Cluster credentials workflow is tested, and that provider can be installed without the need of global credentials.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions