Multi-tenant Flyte deployment

[adartaud]

Hi,

I am currently trying to deploy Flyte in a multi-tenant architecture.
Since user RBAC is currently not supported in Flyte Console and Flyte Admin (granting and limiting users access to specific project-domains), I am trying to deploy multiple control planes inside my Cluster.

Let's say I have namespace A, and namespace B, each containing a Flyte control plane. I'll be able to implement RBAC using my own auth provider, and granting access to each user on their specific flyte console and admin. However, I am not sure on what would be the better approach for the data-plane:

• I could deploy one data-plane per namespace, meaning namespace A and B would both have their own Propeller, and deploying the FlyteWorkflow CRD separately. I tried this approach, but some problems arise since multiple propellers try to modify the same CRD through the Mutating Webhook.
• Another approach could be to deploy a single data-plane inside the cluster, and route all control-planes to the same propeller. However at this stage I am still unsure if this would work, and if this could create some security issues since a single propeller would have all rights.

Is there a recommended way of proceeding ?

Also, do you plan on supporting user's RBAC ?

Thanks a lot,

[kumare3]

Single propeller multiple admins will not work as it has to communicate- but you can deploy different propellers per namespace m. You just have to make sure you start each propeller with limit namespace parameter

[kumare3]

Also talk to union.ai - it has RBAC