From e5788b3466f286fe020bfb0987e98dcc95dd6148 Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 14:58:52 +0200 Subject: [PATCH 1/7] chore: update authors.yaml --- adrs/authors.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/adrs/authors.yml b/adrs/authors.yml index b10247d..3cf2e42 100644 --- a/adrs/authors.yml +++ b/adrs/authors.yml @@ -5,3 +5,9 @@ ValentinGerlach: image_url: /img/authors/ValentinGerlach.png socials: github: ValentinGerlach +MaximilianTechritz: + name: Maximilian Techritz + title: openMCP Contributor + url: https://github.com/maximiliantech + socials: + github: maximiliantech From 28ea5c85f3eab190913b307fed92e2a45a808661 Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 14:59:13 +0200 Subject: [PATCH 2/7] feat(decision): add MCP namespace strategy in platform cluster --- adrs/2025-08-12-mcp-namespace-strategy.md | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 adrs/2025-08-12-mcp-namespace-strategy.md diff --git a/adrs/2025-08-12-mcp-namespace-strategy.md b/adrs/2025-08-12-mcp-namespace-strategy.md new file mode 100644 index 0000000..20d1e8e --- /dev/null +++ b/adrs/2025-08-12-mcp-namespace-strategy.md @@ -0,0 +1,27 @@ +--- +authors: + - MaximilianTechritz +--- + +# MCP Namespace Strategy for Platform Cluster + +## Context and Problem Statement + +In the openMCP platform, we need to determine how to organize resources in the Platform Cluster that belong to Managed Control Planes (MCPs). Each MCP represents a separate tenant or customer environment that needs to be isolated and managed independently. The key question is: Should every MCP on the Platform Cluster have its own Namespace to ensure proper isolation, resource management, and security boundaries? + +Without proper namespace isolation, MCPs could interfere with each other, leading to security vulnerabilities, resource conflicts, and operational complexity. + +## Considered Options + +1. **mcp-{hash-mcp-name-and-namespace}** - Create namespaces using a hash of the MCP name and original namespace (hash < 63 chars) +2. **mcp-{uid}** - Create namespaces using the UID of the MCP resource + +## Decision Outcome + +Option 1: "mcp-{hash-mcp-name-and-namespace}", because it provides unique namespace isolation for each MCP while avoiding conflicts and maintaining deterministic naming that survives backup/restore operations. Option 2 would have been simpler but does not work well with backup/restore scenarios, as the UID can change after a restore operation, leading to potential conflicts and confusion. + +The hash algorithm we will use with Option 1 is [SHAKE128](https://pkg.go.dev/crypto/sha3#SumSHAKE128). It is the only 128-bit algorithm that is FIPS compliant. Through the 128-bit output, we can ensure UUID style. So the namespace could look something like `mcp-3f4b2c1d-8e9a-7b6c-5d4e-3f2a1b0c9d8e`. + +### Consequences + +NONE \ No newline at end of file From 5a4993662c6e56c2db5cff1e96d088ab92a1b5f2 Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 15:25:36 +0200 Subject: [PATCH 3/7] rephrase Co-authored-by: Valentin Gerlach --- adrs/2025-08-12-mcp-namespace-strategy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/adrs/2025-08-12-mcp-namespace-strategy.md b/adrs/2025-08-12-mcp-namespace-strategy.md index 20d1e8e..974b0ac 100644 --- a/adrs/2025-08-12-mcp-namespace-strategy.md +++ b/adrs/2025-08-12-mcp-namespace-strategy.md @@ -18,7 +18,7 @@ Without proper namespace isolation, MCPs could interfere with each other, leadin ## Decision Outcome -Option 1: "mcp-{hash-mcp-name-and-namespace}", because it provides unique namespace isolation for each MCP while avoiding conflicts and maintaining deterministic naming that survives backup/restore operations. Option 2 would have been simpler but does not work well with backup/restore scenarios, as the UID can change after a restore operation, leading to potential conflicts and confusion. +Option 1: "mcp-{hash-mcp-name-and-namespace}", because it provides unique namespace isolation for each MCP while avoiding conflicts and maintaining deterministic naming that survives backup/restore operations. Option 2 would have been simpler but does not work well with backup/restore scenarios, as the UID changes after a restore operation, breaking the link between the MCP and its namespace. The hash algorithm we will use with Option 1 is [SHAKE128](https://pkg.go.dev/crypto/sha3#SumSHAKE128). It is the only 128-bit algorithm that is FIPS compliant. Through the 128-bit output, we can ensure UUID style. So the namespace could look something like `mcp-3f4b2c1d-8e9a-7b6c-5d4e-3f2a1b0c9d8e`. From 38483869fe593fa0a212ec0ea0923c48f3c0edce Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 15:26:06 +0200 Subject: [PATCH 4/7] rephrase Co-authored-by: Valentin Gerlach --- adrs/2025-08-12-mcp-namespace-strategy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/adrs/2025-08-12-mcp-namespace-strategy.md b/adrs/2025-08-12-mcp-namespace-strategy.md index 974b0ac..c588cea 100644 --- a/adrs/2025-08-12-mcp-namespace-strategy.md +++ b/adrs/2025-08-12-mcp-namespace-strategy.md @@ -20,7 +20,7 @@ Without proper namespace isolation, MCPs could interfere with each other, leadin Option 1: "mcp-{hash-mcp-name-and-namespace}", because it provides unique namespace isolation for each MCP while avoiding conflicts and maintaining deterministic naming that survives backup/restore operations. Option 2 would have been simpler but does not work well with backup/restore scenarios, as the UID changes after a restore operation, breaking the link between the MCP and its namespace. -The hash algorithm we will use with Option 1 is [SHAKE128](https://pkg.go.dev/crypto/sha3#SumSHAKE128). It is the only 128-bit algorithm that is FIPS compliant. Through the 128-bit output, we can ensure UUID style. So the namespace could look something like `mcp-3f4b2c1d-8e9a-7b6c-5d4e-3f2a1b0c9d8e`. +The hash algorithm we will use with Option 1 is [SHAKE128](https://pkg.go.dev/crypto/sha3#SumSHAKE128). It is an 128-bit algorithm that is FIPS compliant. The 128-bit output allows us to print the hash in the UUID v8 format. So the namespace could look something like `mcp-3f4b2c1d-8e9a-7b6c-5d4e-3f2a1b0c9d8e`. ### Consequences From fe8eeabd5b3b7fe53391024ff12952fbac7833cc Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 15:26:26 +0200 Subject: [PATCH 5/7] update consequences Co-authored-by: Valentin Gerlach --- adrs/2025-08-12-mcp-namespace-strategy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/adrs/2025-08-12-mcp-namespace-strategy.md b/adrs/2025-08-12-mcp-namespace-strategy.md index c588cea..c235cae 100644 --- a/adrs/2025-08-12-mcp-namespace-strategy.md +++ b/adrs/2025-08-12-mcp-namespace-strategy.md @@ -24,4 +24,4 @@ The hash algorithm we will use with Option 1 is [SHAKE128](https://pkg.go.dev/cr ### Consequences -NONE \ No newline at end of file +- The old hash function `K8sNameHash` should not be used anymore. \ No newline at end of file From 2ded2f8a7ab35d7ef3915381d0e6a328365f3f80 Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 16:58:21 +0200 Subject: [PATCH 6/7] fix: authors file --- adrs/authors.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/adrs/authors.yml b/adrs/authors.yml index 3cf2e42..33d72ef 100644 --- a/adrs/authors.yml +++ b/adrs/authors.yml @@ -5,6 +5,7 @@ ValentinGerlach: image_url: /img/authors/ValentinGerlach.png socials: github: ValentinGerlach + MaximilianTechritz: name: Maximilian Techritz title: openMCP Contributor From 427f121f056751b84630812c486bd8fc8628d3f9 Mon Sep 17 00:00:00 2001 From: Maximilian Techritz Date: Tue, 19 Aug 2025 17:30:00 +0200 Subject: [PATCH 7/7] fix: complie error because of {} --- adrs/2025-08-12-mcp-namespace-strategy.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/adrs/2025-08-12-mcp-namespace-strategy.md b/adrs/2025-08-12-mcp-namespace-strategy.md index c235cae..9e0cfe6 100644 --- a/adrs/2025-08-12-mcp-namespace-strategy.md +++ b/adrs/2025-08-12-mcp-namespace-strategy.md @@ -13,12 +13,12 @@ Without proper namespace isolation, MCPs could interfere with each other, leadin ## Considered Options -1. **mcp-{hash-mcp-name-and-namespace}** - Create namespaces using a hash of the MCP name and original namespace (hash < 63 chars) -2. **mcp-{uid}** - Create namespaces using the UID of the MCP resource +1. **`mcp-{hash-mcp-name-and-namespace}`** - Create namespaces using a hash of the MCP name and original namespace (hash < 63 chars) +2. **`mcp-{uid}`** - Create namespaces using the UID of the MCP resource ## Decision Outcome -Option 1: "mcp-{hash-mcp-name-and-namespace}", because it provides unique namespace isolation for each MCP while avoiding conflicts and maintaining deterministic naming that survives backup/restore operations. Option 2 would have been simpler but does not work well with backup/restore scenarios, as the UID changes after a restore operation, breaking the link between the MCP and its namespace. +Option 1: `mcp-{hash-mcp-name-and-namespace`, because it provides unique namespace isolation for each MCP while avoiding conflicts and maintaining deterministic naming that survives backup/restore operations. Option 2 would have been simpler but does not work well with backup/restore scenarios, as the UID changes after a restore operation, breaking the link between the MCP and its namespace. The hash algorithm we will use with Option 1 is [SHAKE128](https://pkg.go.dev/crypto/sha3#SumSHAKE128). It is an 128-bit algorithm that is FIPS compliant. The 128-bit output allows us to print the hash in the UUID v8 format. So the namespace could look something like `mcp-3f4b2c1d-8e9a-7b6c-5d4e-3f2a1b0c9d8e`.