Questions on Hydra Maester

Site Feedback
#1

Hi,

We’re trying to figure out a proper deployment model for Hydra in a multi-tent scenario.

We’ve reached the conclusion that in order to have true multi-tenancy support on the oauth/oidc side (with Hydra), we need to deploy a single Hydra instance per tenant and distribute the oauth client registrations between these Hydra instances

For distributing the oauth clients between different Hydra instances (in K8S) it is suggested to use Hydra Maester.

We went through the repo and now have a few questions::

  1. it seems this project is still in its early stages, no? As in: the CRD doesn’t support all properties a oauth client can have yet, there’s no retry mechanism yet on the api calls measter makes to hydra. Should we start using this in production already?

  2. it seems that the idea is to have one maester controller running per Hydra instance/deployment, cause as far as I can see the controller doesn’t auto discover all Hydra instances and broadcasts changes to the defined CR’s to all Hydra instances. Is that correct? If so, are there plans to enhance the controller to distribute changes to all (matched) Hydra instances?

TIA,
Paul

#2
  1. it seems this project is still in its early stages, no? As in: the CRD doesn’t support all properties a oauth client can have yet, there’s no retry mechanism yet on the api calls measter makes to hydra. Should we start using this in production already?

Yes, early stages and definitely in a “prototype” phase. But there are migrations paths (e.g. CRD versions) and we are commited to the repository, there’s simply not enough resources atm to spend a lot of time on them.

  1. it seems that the idea is to have one maester controller running per Hydra instance/deployment, cause as far as I can see the controller doesn’t auto discover all Hydra instances and broadcasts changes to the defined CR’s to all Hydra instances. Is that correct? If so, are there plans to enhance the controller to distribute changes to all (matched) Hydra instances?

Correct. As discussed in one of the issues, we will address this.