Tenant concept
Combining clusters and namespaces to differentiate access.
The essence of the implementation
Tenants in the Shturval platform are an additional level of abstraction between the platform and clusters. They allow you to pool resources for unified access control:
- several clusters entirely;
- several namespaces of one cluster;
- several namespaces of several clusters.
Access hierarchy: Platform → Tenants → Clusters → Namespaces. The rights assigned to a tenant apply to all nested objects (clusters and namespaces in it).
By default, system tenants are created:
- platform — includes all clusters and namespaces of the platform;
- tenant per cluster — for each created cluster, a tenant is created, including all namespaces of this cluster.
System tenants cannot be changed, deleted, or duplicated.
In the tenant tree you can delete one child object or several at once. How to select objects and confirm deletion: Bulk deletion.
From an implementation point of view, tenants are represented by custom resources of the API group permissions.shturval.tech. A general overview of these and other custom resources is available on the page “Custom Resources in the Platform”.
Methods of use
By system
If there are several systems on the platform (for example, CRM, ERP, analytics), the clusters and namespaces of each system can be combined into a separate tenant and given unified access to the team responsible for the system.
By environment
If one or more clusters are divided by environment (dev, stage, prod), all namespaces of one environment can be combined into a tenant and given access to the environment.
By namespace type
You can combine system or custom namespaces of different clusters into a tenant to simplify the assignment of rights.
Assigning rights in the tenant
- If a tenant unites entire clusters (namespaces indicate
*), cluster-level access sets are available. - If a tenant combines specific namespaces, access sets of namespace level are available.
Rights are assigned in the Access Control section → Tenant tab. More details: Assigning access rights.
Required permissions
Managing tenants and assigning rights to them is available only to platform users - those who have rights at the platform level.
| Permission | Description | Level |
|---|---|---|
| tenant-get | Obtaining information about a tenant | Platform, Cluster, Namespace |
| tenant-edit | Tenant management (creation, modification, deletion) | Platform, Cluster |
| tenant-role-binder | Managing access in tenants, viewing tenants, section “Access Management” | Platform |
| tenant-role-viewer | Viewing accesses in tenants, manager and access tree | Platform |
More details: Setting permissions.
Release 2.15.0
The main functionality of tenants will be implemented in release 2.15.0. In 2.14, basic options for assigning rights in tenants and viewing the access structure are available.