Allow user to have multiple keypairs

[kyujin-cho]

Main idea

Our current user authentication architecture allows user to have only one keypair at once. Let's extend this architecture so that we can let users create multiple keypairs for a single account.

We can split this issue to smaller chunks, like:

• manager: let main keypair (the one generated when creating user) as a "default keypair" to user, and use it as a login credential when logging in to Backend.AI WebUI with session mode
• manager: add API to support arbitrary keypair creation/removal
  • limit additional keypairs not to have resource limits bigger than default keypair
  • feature: Materialization of the "main" keypair concept #1761 now enforces user-wide resource constraints via the main keypair's resource policy
  • Migrate and merge the keypair resource policy into the user resource policy
• manager: search for usages of keypair in manager code, and if the structure isn't suitable for multiple keypair situation, update it
• webui: create corresponding UI for keypair creation/removal

Side-effects of keypair-based resource policy

• What users wanted
  • lablup/giftbox#191
  • lablup/giftbox#10
  • Bulk-updating project-wise user (=keypair) resource policies with a filtered view of projects that the keypair's owner is a member of.
• We implemented feat: Let the queryfilter-minilang engine to fetch multiple rows from joined tables #1022 to add the "projects" column to the view of "keypairs" in the control panel.
• Side-effects that happened
  • User who doesn't have a project cannot log in. #1625
• 23.09: Polish the current multiple keypair scheme

Tasks

Preview Give feedback

1. fix: Unable to login and missing keypairs when a user does not have any project #1360
   comp:manager size:M type:bug urgency:4 +4
   
2. feature: Materialization of the "main" keypair concept #1761
   comp:client comp:manager require:db-migration size:L +4
   
3. fix: Update fixtures to include setting main keypairs #1785
   comp:client comp:manager size:XL type:enhance +4
   
4. fix: Regression of purging user due to fkey constraint of main_access_key #1775
   comp:manager require:db-migration size:M skip:changelog urgency:blocker +5
   

• 24.03: Ultimately we need to deprecate per-keypair resource policy and keep per-user resource policy only.
  • fix: Deprecates querying projects from KeyPair query #1779
  • Split the users table into identities and user_profiles #1783