feat: retain Kratos identities during management handoff #70

Merged

binjovi-bot merged 2 commits from feat/retain-identity-on-delete into trunk

2026-09-06 02:41:19 +00:00

sean commented

2026-09-06 02:16:44 +00:00

Owner

The field uses the existing shared reconciliation policy. The generated CRD admits only Delete or Retain. Tests cover retained identities with and without a saved ID, absent client configuration and Secret, and continued finalizer retention for default or explicit Delete during a Kratos outage.

Validation: failing tests against the old behavior, passing focused tests, make manifests generate, make lint-fix (0 issues), and make test with Kubernetes envtest.

Add spec.deletionPolicy with Delete as the backward-compatible default. Retain removes the Kubernetes finalizer without resolving the Kratos client, reading a password Secret, or calling the Kratos API. This allows transfer of identity management while preserving the live account and credentials. The field uses the existing shared reconciliation policy. The generated CRD admits only Delete or Retain. Tests cover retained identities with and without a saved ID, absent client configuration and Secret, and continued finalizer retention for default or explicit Delete during a Kratos outage. Validation: failing tests against the old behavior, passing focused tests, make manifests generate, make lint-fix (0 issues), and make test with Kubernetes envtest.

sean added 1 commit

2026-09-06 02:16:44 +00:00