docs: sync haven-parity-plan.md with the landed oidc-provider contract (#370)

Open Beginner friendly
  • Is something wrong?
#1,114 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Domain
authentication, documentation

Research direction

Start with the three spots in docs/haven-parity-plan.md (around lines 50, 231 and 317) and compare them with shared/contracts/oidc-provider.yaml and modules/identity/keycloak/module.yaml. Replace the draft and 'closes #370' wording with the landed oidc-provider state, and check that docs/plan/k8s-haven-mvp.md section 13 still links correctly. Done when no draft language remains, the files agree, and npx [email protected] passes. Confirm the identity-broker question with a maintainer before changing the section 3.7 wording.

Written by the indexing model from the issue text.

Description

area:docs enhancement priority:low size:small

Problem

docs/haven-parity-plan.md still describes the Keycloak identity contract as not-yet-existing, while the contract has landed:

  • Line 50 (section 2 gap summary): "No cert-management, service-mesh, or IAM/identity-broker modules yet — tracked by ... #370 (identity)"
  • Line 231 (section 3.7 maturity tiers): "Secured | ... or an identity-broker provider alongside a separate OIDC provider"
  • Line 317 (section 7 module table, row "3.4 Security — identity/SSO"): "new identity-broker contract | Already scaffolded on branch feat/identity-keycloak-module (draft, closes #370) — needs consumes/provides filled in ..."

Reality on main: #370 is closed, shared/contracts/oidc-provider.yaml exists, and modules/identity/keycloak provides the oidc-provider contract with Superset consuming it (#1064). Found during review of PR #1104, whose runbook (docs/plan/k8s-haven-mvp.md section 13) correctly uses oidc-provider.

Proposal

Update the three spots in docs/haven-parity-plan.md to describe the landed state: the oidc-provider contract exists and Keycloak provides it (#370 closed, Superset OIDC via #1064); the remaining Keycloak gaps are the ones tracked by #682 (hardcoded KC_DB: postgres), #974 (prod web-serving default / E140) and #1075 (no kubernetes: block). Adjust the Secured-tier wording in section 3.7 if identity-broker was meant as a distinct future contract rather than stale naming.

Success criteria

  • No "draft / new identity-broker / closes #370" language remains for the landed contract; sections 2, 3.7 and 7 agree with shared/contracts/oidc-provider.yaml and modules/identity/keycloak/module.yaml.
  • npx [email protected] docs/haven-parity-plan.md passes.
  • Cross-links from docs/plan/k8s-haven-mvp.md stay valid.

One question

Was "identity-broker" intended as a separate future contract (distinct from oidc-provider), or is it stale naming for the landed #370 contract?

Impact / effort

Docs only; no code, contracts, or profiles touched. Effort: ~0.5 h. Origin: review of PR #1104 (loose end, out of that PR's scope).

Dominant language
Python
Stars
8
Forks
12
Avg merge
12h 57m
Merged PRs (30d)
190

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from RonaldHensbergen/composable-data-stack

All issues in RonaldHensbergen/composable-data-stack

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.