search

konveyor / enhancements

Enhancements tracking repository for Konveyor
Apache License 2.0
3 stars 33 forks source link

[RFE] Multi-tenancy: Expand RBAC controls for users to allow finer grained control of applications #110

Open jwmatthews opened 1 year ago

jwmatthews commented 1 year ago

"As an administrator of Konveyor, I want the ability to enforce granularity in application visibility for specific users. For example if I am user A, I'd like to see in Application Inventory only applications with user A as owner/stakeholder and not applications belonging to other people."

Above is a RFE discussed in #konveyor kubernetes.slack.com (link)

jwmatthews commented 1 year ago

@chinmayshrikhande would you provide a little context of your use-case to help us learn more?

chinmayshrikhande commented 1 year ago

Hi @jwmatthews ,

The use case is similar to what is mentioned in this ticket, i.e. User A should be able to see only the applications which he/she has created or is a stakeholder of or is given access to the application and not all the applications.

Also, another use case is separation at the user group level. Any application from Group A should not be available to Group B users. Within each group, we can enforce the application accessibility rules.

This will help to maintain a clear separation between the two different teams.

Is there any tentative date for the release of this feature?

Thanks!

jwmatthews commented 1 year ago

@chinmayshrikhande thank you for sharing the above info.

I don't know if this RFE will be accepted, and if so when we could implement it.

The best I can say is for the next ~3 months our team is heavily focused on Dynamic Reports and establishing the Java LSP Analyzer to allow multi-language support, https://github.com/orgs/konveyor/projects/59

After we have hit that milestone, we will have a better idea of next set of RFEs we can target.

shawn-hurley commented 1 year ago

Not commenting on the timeline as I don't know what this would require. Still, these more granular ACL-like permissions are something that I think is going to be table stakes if we ever use this as a service and/or for anyone wanting to provide this as a service internally to their teams.

jwmatthews commented 1 year ago

Consider that for some use-cases an organization can install Konveyor into separate namespaces to separate data. The below PR enables install of Konveyor in multiple namespaces:

https://github.com/konveyor/tackle2-operator/pull/203

jwmatthews commented 10 months ago

Related request in #konveyor slack for:

multi-tenancy is also a feature that is required if you want to use Konveyor as a central instance for multiple teams