Limit reset logic in incus-user to support more advanced environments

[rsyring]

Is there an existing issue for this?

• There is no existing issue for this feature

What are you currently unable to do

I'm working on building an app deployment utility on top of Incus. We make heavy use of user constrained projects where the user represents a "stack" of applications that are getting deployed. Similar to how a docker compose file manages a group of apps that work together.

Currently, this results in a lot of projects on the system named like "user-1234" which is a real hit to discoverability/usability as there is a constant need to mentally map the project name to the stack.

Instead, we'd like to be able to set or change the project name arbitrarily for a user constrained project (like any other project) and request that Incus changes to using config or metadata to find a user's project instead of the project's name.

What do you think would need to be added

When Incus needs to create or find a user constrained project, first look for a config or metadata entry on projects.

For example, add a config entry on project's named restricted.constrained-uid that gets set to the system user's uid when the project is created for that user.

For backwards compatibility, if no project is found using the above method, then fall back to the current method of looking for a matching project name.

FWIW, we pre-create the project for our stack users so we'd set the project name differently from the beginning and set the config value to that user's UID so Incus knows how to link it when the user connects to Incus.

[stgraber]

Incus doesn't actually care about the project name at all. We only use user-UID to avoid getting conflicts for the projects that we auto-create.

[stgraber]

So the user-UID projects will get auto-created when not found, but you can create more projects and manage who sees what without it being a problem.

[stgraber]

root@dakara:~# incus project list
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
|       NAME        | IMAGES | PROFILES | STORAGE VOLUMES | STORAGE BUCKETS | NETWORKS | NETWORK ZONES |               DESCRIPTION                | USED BY |
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
| default (current) | YES    | YES      | YES             | YES             | YES      | YES           | Default Incus project                    | 31      |
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
| demo              | YES    | YES      | YES             | YES             | NO       | NO            |                                          | 1       |
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
| foo               | YES    | YES      | YES             | YES             | NO       | YES           | User restricted project for "foo" (1001) | 1       |
+-------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
root@dakara:~# su foo
foo@dakara:/root$ incus project list
+---------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
|        NAME         | IMAGES | PROFILES | STORAGE VOLUMES | STORAGE BUCKETS | NETWORKS | NETWORK ZONES |               DESCRIPTION                | USED BY |
+---------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
| user-1001 (current) | YES    | YES      | YES             | YES             | NO       | YES           | User restricted project for "foo" (1001) | 1       |
+---------------------+--------+----------+-----------------+-----------------+----------+---------------+------------------------------------------+---------+
foo@dakara:/root$ 
exit
root@dakara:~# incus config trust list
+-----------------+--------+-------------+--------------+----------------------+
|      NAME       |  TYPE  | DESCRIPTION | FINGERPRINT  |     EXPIRY DATE      |
+-----------------+--------+-------------+--------------+----------------------+
| incus-user-1001 | client |             | 59eb18b8623c | 2035/07/04 12:08 EDT |
+-----------------+--------+-------------+--------------+----------------------+
root@dakara:~# incus config trust edit 59eb
root@dakara:~# incus config trust show 59eb
name: incus-user-1001
type: client
restricted: true
projects:
- demo
certificate: |
  -----BEGIN CERTIFICATE-----
  MIIB0jCCAVigAwIBAgIQEv6e7LDL+8CYke0q50YUhTAKBggqhkjOPQQDAzAxMRkw
  FwYDVQQKExBMaW51eCBDb250YWluZXJzMRQwEgYDVQQDDAtyb290QGRha2FyYTAe
  Fw0yNTA3MDYxNjA4NThaFw0zNTA3MDQxNjA4NThaMDExGTAXBgNVBAoTEExpbnV4
  IENvbnRhaW5lcnMxFDASBgNVBAMMC3Jvb3RAZGFrYXJhMHYwEAYHKoZIzj0CAQYF
  K4EEACIDYgAEuIJv6/m1WVoGABAGX6ljt1sg1mnSZrMquUL4Fykd8/QCx/v/z3iV
  pku08AMR+i4Osz5mMvk3kH096xKwR/aq/UxU3hp6C6obG2poY0sBhaTj4DAhh9aK
  AcJzO8A9rzqgozUwMzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH
  AwIwDAYDVR0TAQH/BAIwADAKBggqhkjOPQQDAwNoADBlAjEA0hRIP9MyCtBWQrei
  /wL6aDgnHfI3XsQ8obKsQndcdBqdU4Sp/MLfbLJMkBje0UlBAjB2SaKv3BAr0VDQ
  WEl1ubtduRzMVwPX68MpVlxSo1DCDF6INpJ9zqNUwGUAmKWjQ7w=
  -----END CERTIFICATE-----
description: ""
fingerprint: 59eb18b8623cc5dd9ce5af200f2c544ec327f3a4b2c21f3ce6927f4520373d42
root@dakara:~# su foo
foo@dakara:/root$ incus project list
+------+--------+----------+-----------------+-----------------+----------+---------------+-------------+---------+
| NAME | IMAGES | PROFILES | STORAGE VOLUMES | STORAGE BUCKETS | NETWORKS | NETWORK ZONES | DESCRIPTION | USED BY |
+------+--------+----------+-----------------+-----------------+----------+---------------+-------------+---------+
| demo | YES    | YES      | YES             | YES             | NO       | NO            |             | 1       |
+------+--------+----------+-----------------+-----------------+----------+---------------+-------------+---------+
foo@dakara:/root$ 

[stgraber]

Deleting the project will cause it to get re-created though (same as if you rename it) as on most systems using such projects, you want things to get re-created if deleted or broken by mistake (saves us a bunch on support questions from confused users).

[rsyring]

Thanks for the response and demo. I see how that can work.

For this use case, it's not ideal to always have the 'user-1234' projects hanging around when they aren't needed. But, it is one step up from having to do the mental mapping that I'm doing now.

It seems like it would be a relatively small amount of work to support the config/metadata approach for linking. Maybe a handful of small adjustments to incus_user with perhaps one core change for whatever the project config/meta key would be.

Or, could there be a global config flag to not create the "user-1234" projects?

If you are open to either approach, I'll put up a PR for your review. If it's not worth the trouble for this niche use case, np. :)

Thanks.

[stgraber]

I'm not in favor of a project config key option for this. It may be possible to do it in a safe way but that'd be a weird specialized option when Incus is otherwise currently completely unaware of the incus-user mechanism.

I think a better approach would be to only reset the project if the user doesn't have access to another, which is something that can be checked through the /1.0/certificates endpoint.
That would allow for the renaming or deletion of the project so long as the user keeps access to at least one project.