Closed byewokko closed 9 months ago
Space ID cannot contain "." while tenant ID can. It is replaced with "--".
Tenants should not allow "." either, for multiple reasons. Do we have tenants with "." anywhere?
I suggest to disable "." in tenant name during validation.
Space ID default is reserved in Kibana. Because of that, Seacat tenant default is mapped to space seacat-default.
"tenant-default" is better, "SeaCat" is not a known concept in many deployments.
Breaking changes
kibana_url
. If this is empty, Kibana space sync is disabled.elk:
-prefixed resources are still mapped to corresponding Kibana roles for backward compatibility.batman:elk
has been renamed tobatman:kibana
. The old config still works as fallback.Changes
my-company
) is created in Seacat Auth, Batman service creates a space in Kibana (space_id=my-company
) and two Elastic roles with access to that space:tenant_my-company_read
with read-only privileges,tenant_my-company_all
with read-write privileges.kibana:access
maps to specific role that grants read-only access to corresponding tenant space (e.g.tenant_my-company_read
),kibana:edit
maps to specific role that grants read-write access to corresponding tenant space (e.g.tenant_my-company_all
),kibana:admin
maps to Kibanakibana_admin
role,authz:superuser
maps to Elasticsuperuser
.elk:
-prefixed resources are still mapped to corresponding Kibana roles (e.g. resourceelk:analyst
will be mapped to Kibana'sanalyst
role as before).