Best practices for managing accounts/users between environments?

[dennispan]

Currently when setting up the dev environment accounts and users, we had to note down the steps we did and replicate exactly what we did in prod, but under a different Operator

I imagine over time this can lead to human errors like forgetting to note down a step, failing to execute a step, etc. Especially we only store the JWT in the repo, which is hard to compare the settings.

What are some recommendations here? I'm thinking maybe we can add some automation in CI pipeline to decode the jwt during PRs and show the diff, so that at least it is easier to see what's changing.

[aricart]

If you want to duplicate environments under a different operator, there's: nsc reissue -h. The main thing is that accounts will be with the same keys. I have a PR for doing the same with accounts #620, I'll merge that. Now the intention is not to duplicate. But with these building blocks we can start solving this problem, let me think of it.

[aricart]

Started a PR #704 - while we have some tools for reissuing etc, for some of these manipulations it would be better to export everything about an operator into a file, and the re-import it, with an optional change in the operator name, and possibly re-generating all keys. - This effectively can be used not only for easy backup (all in a single file), but also to duplicate environments.