Change Details

In private repo, the users `rsyslog` and `echostore` share the same id. I *guess* echostore currently wins as it comes last in the list and because it seems to be working, at least deployments do. The docs say [1][2]: > UID: a string which identifies the end user and attempts to be more consistent and unique than username. So maybe we could just drop the numeric ID from hiera and use the username as UID as well (as I think we aim for them to be unique anyways)? When we decide to change that, we could also rename the "type" field to "group" to better reflect what it actually is. [1] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies [2] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file

In private repo, the users `rsyslog` and `echostore` share the same id. I *guess* echostore currently wins as it comes last in the list and because it seems to be working, at least deployments do. The docs say [1][2]: > UID: a string which identifies the end user and attempts to be more consistent and unique than username. So maybe we could just drop the numeric ID from hiera and use the username as UID as well (as I think we aim for them to be unique anyways)? When we decide to change that, we could also rename the "type" field to "group" to better reflect what it actually is. The proposed patch adds to new "after-migration" tasks: [] Remove the packages_from_future gate after migrating all clusters to kubernetes 1.16 [] Remove the groups gate after migrating all user stanzas from type to groups [1] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies [2] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file

In private repo, the users `rsyslog` and `echostore` share the same id. I *guess* echostore currently wins as it comes last in the list and because it seems to be working, at least deployments do. The docs say [1][2]: > UID: a string which identifies the end user and attempts to be more consistent and unique than username. So maybe we could just drop the numeric ID from hiera and use the username as UID as well (as I think we aim for them to be unique anyways)? When we decide to change that, we could also rename the "type" field to "group" to better reflect what it actually is. The proposed patch adds to new "after-migration" tasks: [] Remove the packages_from_future gate after migrating all clusters to kubernetes 1.16 [] Remove the groups gate after migrating all user stanzas from type to groups [1] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies [2] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file