Console over-restrains allowed role names

[JFlath]

In Console we apply this filter:

console/proto/redpanda/api/console/v1alpha1/security.proto

Line 80 in c99b26e

(buf.validate.field).string.pattern = "^[a-zA-Z0-9-_]+$"

However Redpanda itself isn't so strict:

https://github.com/redpanda-data/redpanda/blob/dev/src/v/redpanda/admin/security.cc#L293
vvv
https://github.com/redpanda-data/redpanda/blob/0c0a3db581140bb2b8e0d6624cb4eabb697449d7/src/v/security/scram_algorithm.cc#L362
vvv
https://github.com/redpanda-data/redpanda/blob/0c0a3db581140bb2b8e0d6624cb4eabb697449d7/src/v/security/scram_algorithm.cc#L193
vvv
https://github.com/redpanda-data/redpanda/blob/0c0a3db581140bb2b8e0d6624cb4eabb697449d7/src/v/security/scram_algorithm.cc#L34-L45

Redpanda's implementation seems inkeeping with others. Notably, Console doesn't allow . in a Role

[JFlath]

N.B. The line referenced is one example, but the same applies for all requests in that file (and possibly more broadly)

[weeco]

I think we had discussions about constraining the character set for roles to the same rules that apply to topics. Reason being things such as:

• More complex characters usually not needed / desired
• URL encoding (in Console and Admin API)
• We'd need to ensure we can display all allowed characters and length accordingly
• We may want to be a bit opinionated to establish some convention on the naming
• We can always become less strict but not the other way round, hence we started with this character set

Is there a specific reason to relax the requirements?

[JFlath]

So at the moment you can use rpk to create a role called my.team - Console will then fail to work with that correctly even though it's a real role that exists within Redpanda. I agree with the points raised, but the convention/standard has already been defined by what we allow in Redpanda itself

[weeco]

The API is cloud exclusive and RPK uses that API as well. In RP Cloud no one can create a role with a different convention because everything has to go through console

[JFlath]

We may be talking cross purposes here, not sure - rpk security role create my.team uses Redpanda's Admin API directly (/v1/security/roles) and is available on Self Hosted clusters. I do see this in the code though that seems to suggest we permanently gate this?

https://github.com/redpanda-data/console/blob/master/frontend/src/state/supportedFeatures.ts#L54-L56

[burandobata]

I think we had discussions about constraining the character set for roles to the same rules that apply to topics. Reason being things such as:

Currently with console you can also create a topic containing . like test.example, but you can't create role like that. So this is not consistent.