8000 Client API v2 CLI client: rename `update` command to `apply` to reflect that it can create resources as well as update them by michalvavrik · Pull Request #48134 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

Client API v2 CLI client: rename update command to apply to reflect that it can create resources as well as update them - #48134

Merged
vmuzikar merged 1 commit into
keycloak:mainfrom
michalvavrik:feature/issues/47472
Apr 22, 2026
Merged

vmuzikar merged 1 commit into
keycloak:mainfrom
michalvavrik:feature/issues/47472

Conversation

@michalvavrik
@michalvavrik michalvavrik commented Apr 16, 2026 •
Copy link
Copy Markdown
Member
  • Closes: Client API v2 CLI client: rename update sub-command to reflect the fact it either create or update client #47472
  • Problem with update command is that it is misleading, therefore the command we generate for the PUT HTTP method, which either creates or updates a resource, is now called 'apply'.
  • I also realized there isn't a single test using --uuid option and verifying that we print clear validation failure when user specified a wrong UUID, so I added it as it can happen.
  • The --uuid option is removed from create command as it is ignored and users could be pretty confused if we allow them to specify --uuid which is later ignored. On the other hand, I kept it for patch and apply commands as there, users can use it as additional measure to ensure they are updating the same client (if someone had renamed the clients (e.g. A -> B & C -> A), then UUID check would fail

@Pepo48
Pepo48 commented Apr 17, 2026 •
Copy link
Copy Markdown
Contributor

@michalvavrik first of all, thanks for another CLI improvement!

I know that discarding UUID silently on create-via-PUT was a design choice, discussed many times, so certainly I don't want to re-open it. I just really don't like the CLI UX consequence of it, especially now, when I have it just in front of my eyes:

kcadm.sh --v2 client apply oidc uuid-new-client \
  --client-id uuid-new-client \
  --uuid aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
  --enabled true

works, returns the real server-generated UUID. Naturally then, the following also works:

kcadm.sh --v2 client apply oidc uuid-test-client \
  --client-id uuid-test-client \
  --uuid db20fee0-874d-4af5-b1c1-cddfb713cdc8 \
  --enabled false 

And then the one I started with fails, although expectedly:

kcadm.sh --v2 client apply oidc uuid-test-client \
  --client-id uuid-test-client \
  --uuid aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
  --enabled false

You mentioned create in the PR description, but even for apply I consider it to be a bit unfortunate UX, mainly when we realize that I just shown 3 examples of the same command, with the same set of params.

So rather a question here - should we do something about it as well?

@shawkins
Copy link
Copy Markdown
Contributor

We need to do something about it.

The only other behavior we're discussing is to disallow the uuid from being present when performing a create with a PUT. That would change the first apply in your scenario to a failure.

This also matches with kubernetes server side apply. In a similar situation you would see an error like:

error: Operation cannot be fulfilled on deployments.apps "nginx-deployment": uid mismatch: the provided object specified uid 34b9d9c4-6abf-472d-9158-6be8fe64f218, and no existing object was found Please review the fields above--

@Pepo48
Pepo48 commented Apr 17, 2026 •
Copy link
Copy Markdown
Contributor

We need to do something about it.

The only other behavior we're discussing is to disallow the uuid from being present when performing a create with a PUT. That would change the first apply in your scenario to a failure.

Just seconds before you Steve posted the reaction, I re-formulated my last sentence, as I was less and less sure what and how it should be done. 😊 Thanks for the info, it may be a good alternative or it's just a knee-jerk reaction from me and all I need is to use to the UX after all.

@michalvavrik
Copy link
Copy Markdown
Member Author

We need to do something about it.

The only other behavior we're discussing is to disallow the uuid from being present when performing a create with a PUT. That would change the first apply in your scenario to a failure.

Just seconds before you Steve posted the reaction, I re-formulated my last sentence, as I was less and less sure what and how it should be done. 😊 Thanks for the clarification, it well maybe just a knee-jerk reaction from me and all I need is to use to the UX after all.

@Pepo48 & @shawkins I was explicitly told by @vmuzikar before I started that supplying uuid param is required as users can c&p resources from one KC instance to another instance. Now, it may only be valid for -f patch.json and not for --uuid. But --uuid for update-only scenarios is useful (from my POV, I have no idea what users do) as it prevents you from modifying a different resource (client can be renamed), so if you want to only modify the one client, it gives you an advantage.

IMO we shouldn't do client-side validation of presence of uuid for create scenarios with create or apply commands, since unlike Kubernetes, we don't have resource versions, we have no way to determine if something has changed, hence it would be racy.

If you feel strongly about it, I don't mind dropping --uuid as users can always specify it in the file if they have such a use case. I am just worried we are going in a circles. All I need is agreement among you guys 😄

@shawkins
Copy link
Copy Markdown
Contributor

To be clear, the change in behavior I'm talking about would be on the server side, not the tooling.

@michalvavrik
michalvavrik commented Apr 17, 2026 •
Copy link
Copy Markdown
Member Author

To be clear, the change in behavior I'm talking about would be on the server side, not the tooling.

In that case I am +1, but as far as I understand the situation, there wasn't agreement on such change on Wednesday. I can create a new sub-task outside of the MVP task group, e.g. under Client v2 enhancements #47822, so that we can revisit it?

@vmuzikar
Copy link
Copy Markdown
Contributor

I'd remove --uuid completely for all commands, if no one feels strongly about it. It's server managed, there's no point in exposing it as an argument. It might be extremely confusing to the user to have it there.

But --uuid for update-only scenarios is useful (from my POV, I have no idea what users do) as it prevents you from modifying a different resource (client can be renamed), so if you want to only modify the one client, it gives you an advantage.

That IMHO makes sense mostly only for file input – I fetch the client and store it to file, make some modifications, and PUT it back to the server. Then the validation fails if the resource was renamed.

@michalvavrik
michalvavrik force-pushed the feature/issues/47472 branch from 2a5bd3e to 52ccc50 Compare April 17, 2026 17:27
@michalvavrik
Copy link
Copy Markdown
Member Author

I'd remove --uuid completely for all commands, if no one feels strongly about it. It's server managed, there's no point in exposing it as an argument. It might be extremely confusing to the user to have it there.

done, thanks for moving this discussion forward

* Closes: keycloak#47472
* Problem with 'update' command is that it is misleading, therefore the command we generate for 'PUT' HTTP method, which either creates or updates a resource, is now called 'apply'.
* The '--uuid' option is removed from commands

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
@michalvavrik
michalvavrik force-pushed the feature/issues/47472 branch from 52ccc50 to 87f0fd1 Compare April 17, 2026 17:39
@shawkins
Copy link
Copy Markdown
Contributor

done, thanks for moving this discussion forward

I agree with removing the parameter. About the only thing useful to do with something like that would be to unset the field.

We'll just need to rely on users understanding the purpose of the UUID and the clarity of server side error messages.

Rest assured someone will start off by fetching a resource from a different server, then try to apply the file twice, and see the the second apply.

@michalvavrik
Copy link
Copy Markdown
Member Author

About the only thing useful to do with something like that would be to unset the field.

I wanted to discuss this today on the WG meeting but there wasn't time. I am not sure if we should do that.

One thing that I found out yesterday when working on the edit command was that it is currently not possible to rename client (change client id), I didn't find a way.

@shawkins
Copy link
Copy Markdown
Contributor

One thing that I found out yesterday when working on the edit command was that it is currently not possible to rename client (change client id), I didn't find a way.

I think the general plan is to tackle renames later, if at all. There's a lot of details to straighten out about the renaming operation - some stuff we're associating by name, other it's by uuid. So for now for client admin api v2 we're just assuming that users will delete and recreate.

@shawkins shawkins left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks @michalvavrik

@vmuzikar vmuzikar left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks.

@vmuzikar
vmuzikar merged commit a05b1c9 into keycloak:main Apr 22, 2026
86 checks passed
@michalvavrik
michalvavrik deleted the feature/issues/47472 branch April 22, 2026 09:24
@stianst stianst mentioned this pull request Jun 1, 2026
sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026
* Closes: keycloak#47472
* Problem with 'update' command is that it is misleading, therefore the command we generate for 'PUT' HTTP method, which either creates or updates a resource, is now called 'apply'.
* The '--uuid' option is removed from commands

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Client API v2 CLI client: rename update sub-command to reflect the fact it either create or update client

4 participants

0