Feature Request: To be able to separate customer projects from each other ie. not seeing each others git repos

Is your feature request related to a problem?

The problem is that there are no good way to separate customer projects in the continuous delivery page.

And as an administrator I do not want to create the git repos since I then must have access to the git repos and schedule token renewals.

Solution you'd like

I would like to have similar concept of rancher-projects for continuous delivery part. Admin would create a project and set allowed namespaces that that project is allowed to deploy to. Admin would also set allowed clusters to be deployed to. Admin would set allowed members for that project.

Within that project users can add their own git repos.

Alternatives you've considered

Workspaces seem like a good start but a few problems I experience:

How do I add the same clusters from fleet-default to a new workspace? There is a function to move clusters between workspaces but I would rather copy between workspaces, a lot of customer projects will deploy to the same clusters.
If giving access to a workspace by going to local rancher cluster and adding a project and moving the workspace-namespace to that project and then giving the project some members those members will also see the local cluster.

I know that I can hide the local cluster but then it is also hidden from administrators.

Anything else?

No response

rancher / fleet