Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 3 additions & 34 deletions mission-control/docs/guide/permissions/concepts/multi-tenancy.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,38 +4,7 @@
---

Mission Control provides sophisticated access control mechanisms for complex deployment scenarios, particularly in Software-as-a-Service (SaaS) environments where multiple tenants or organizations share the same infrastructure.
Two key features enable fine-grained access control in these scenarios: Agent-based permissions and Tag-based permissions.

### Agent based permission

Mission Control often acts as a central hub receiving data from multiple agents deployed across different environments. Each agent pushes its own set of resources, including catalogs and topologies, to the central Mission Control instance. While all these resources are accessible through a unified UI portal, organizations frequently need to restrict user access to specific agent-sourced data.
Agent-based ABAC addresses this requirement by allowing administrators to create permissions that reference specific agents.
For example, you might have:

- Development teams that should only access resources from their development environment agents
- Regional teams that should only see resources from agents in their geographic location
- Client-specific teams that should only interact with agents deployed in their infrastructure

```yaml title="agent-based-permission.yaml" file=<rootDir>/modules/mission-control/fixtures/permissions/agent-based-permission.yaml

```

### Tag based permission

Tag-based permissions provide another layer of access control granularity by allowing administrators to restrict access based on resource tags.
This approach is particularly powerful for managing access in multi-cluster Kubernetes environments.
Tags can represent various attributes such as:

- Environment (production, staging, development)
- Geographic region (us-east, eu-west, asia-pacific)
- Business unit (finance, marketing, operations)
- Client identifier (client-a, client-b)
- Clusters

```yaml title="tag-based-permission.yaml" file=<rootDir>/modules/mission-control/fixtures/permissions/tag-based-permission.yaml

```

:::info
Tag-based and agent-based permissions can be combined to create sophisticated access control policies that precisely match organizational requirements and security boundaries.
:::
Mission Control often acts as a central hub receiving data from multiple agents deployed across different environments.
Each agent pushes its own set of resources, including catalogs and topologies, to the central Mission Control instance.
While all these resources are accessible through a unified UI portal, organizations frequently need to restrict user access to specific agent-sourced data.

Check notice on line 10 in mission-control/docs/guide/permissions/concepts/multi-tenancy.md

View workflow job for this annotation

GitHub Actions / vale

[vale] mission-control/docs/guide/permissions/concepts/multi-tenancy.md#L10

[Flanksource.ComplexWords] Consider using 'often' instead of 'frequently'.
Raw output
{"message": "[Flanksource.ComplexWords] Consider using 'often' instead of 'frequently'.", "location": {"path": "mission-control/docs/guide/permissions/concepts/multi-tenancy.md", "range": {"start": {"line": 10, "column": 85}}}, "severity": "INFO"}
2 changes: 1 addition & 1 deletion modules/config-db
Submodule config-db updated 58 files
+8 −0 .github/dependabot.yml
+8 −5 .github/workflows/build-debug.yml
+5 −2 .github/workflows/build.yml
+3 −3 .github/workflows/lint.yml
+42 −39 .github/workflows/release.yml
+4 −4 .github/workflows/scorecard.yml
+22 −22 .github/workflows/test.yml
+1 −0 .gitignore
+22 −0 .trivyignore
+2 −2 Makefile
+82 −0 SECURITY.md
+34 −1 api/v1/common.go
+1 −0 api/v1/interface.go
+4 −0 api/v1/scrapeplugin_types.go
+1 −0 api/v1/types.go
+48 −0 api/v1/zz_generated.deepcopy.go
+1 −1 build/Dockerfile
+866 −0 chart/crds/configs.flanksource.com_scrapeconfigs.yaml
+54 −0 chart/crds/configs.flanksource.com_scrapeplugins.yaml
+2 −0 cmd/operator.go
+36 −0 config/schemas/config_aws.schema.json
+36 −0 config/schemas/config_azure.schema.json
+36 −0 config/schemas/config_azuredevops.schema.json
+36 −0 config/schemas/config_file.schema.json
+36 −0 config/schemas/config_gcp.schema.json
+36 −0 config/schemas/config_githubactions.schema.json
+36 −0 config/schemas/config_http.schema.json
+36 −0 config/schemas/config_kubernetes.schema.json
+36 −0 config/schemas/config_kubernetesfile.schema.json
+36 −0 config/schemas/config_logs.schema.json
+36 −0 config/schemas/config_slack.schema.json
+36 −0 config/schemas/config_sql.schema.json
+36 −0 config/schemas/config_terraform.schema.json
+36 −0 config/schemas/config_trivy.schema.json
+39 −0 config/schemas/scrape_config.schema.json
+4 −3 db/config.go
+8 −0 db/config_scraper.go
+44 −1 db/models/config_item.go
+7 −0 db/scrape_plugin.go
+25 −8 db/update.go
+59 −0 fixtures/plugins/aws-locations.yaml
+0 −0 fixtures/plugins/exclude-info-changes.yaml
+89 −0 fixtures/plugins/k8s.yaml
+0 −0 fixtures/plugins/kubernetes-change-type-mapping.yaml
+279 −267 go.mod
+667 −996 go.sum
+9 −2 jobs/jobs_test.go
+6 −2 jobs/sync_upstream.go
+20 −0 osv-scanner.toml
+2 −0 scrapers/common.go
+18 −4 scrapers/gcp/gcp.go
+7 −1 scrapers/gcp/gcp_test.go
+42 −1 scrapers/kubernetes/hook_argo.go
+39 −22 scrapers/kubernetes/hook_flux.go
+14 −0 scrapers/kubernetes/hooks.go
+66 −29 scrapers/kubernetes/kubernetes.go
+75 −0 scrapers/processors/json.go
+94 −0 scrapers/system/system.go
2 changes: 1 addition & 1 deletion modules/duty
Submodule duty updated 127 files
2 changes: 1 addition & 1 deletion modules/mission-control
Submodule mission-control updated 172 files
2 changes: 1 addition & 1 deletion modules/mission-control-chart
Submodule mission-control-chart updated 35 files
+2 −0 .github/workflows/release.yml
+3 −3 .github/workflows/test.yml
+23 −1 Makefile
+2 −2 agent-chart/Chart.yaml
+4 −5 agent-chart/README.md
+8 −8 agent-chart/values.yaml
+3 −3 chart/Chart.yaml
+6 −5 chart/README.md
+1 −1 chart/crds/mission-control.flanksource.com_applications.yaml
+1 −1 chart/crds/mission-control.flanksource.com_connections.yaml
+1 −1 chart/crds/mission-control.flanksource.com_incidentrules.yaml
+1 −7 chart/crds/mission-control.flanksource.com_notifications.yaml
+1 −1 chart/crds/mission-control.flanksource.com_notificationsilences.yaml
+1 −1 chart/crds/mission-control.flanksource.com_permissiongroups.yaml
+30 −6 chart/crds/mission-control.flanksource.com_permissions.yaml
+1 −6 chart/crds/mission-control.flanksource.com_playbooks.yaml
+273 −0 chart/crds/mission-control.flanksource.com_scopes.yaml
+316 −14 chart/crds/mission-control.flanksource.com_views.yaml
+3 −0 chart/templates/deployment.yaml
+3 −2 chart/templates/rbac.yaml
+7 −1 chart/values.schema.json
+14 −9 chart/values.yaml
+512 −0 crd-chart/templates/canary-checker.flanksource.com_Canary.yaml
+4,302 −1,090 crd-chart/templates/configs.flanksource.com_scrapeconfigs.yaml
+54 −0 crd-chart/templates/configs.flanksource.com_scrapeplugins.yaml
+449 −0 crd-chart/templates/mission-control.flanksource.com_applications.yaml
+1 −1 crd-chart/templates/mission-control.flanksource.com_connections.yaml
+1 −1 crd-chart/templates/mission-control.flanksource.com_incidentrules.yaml
+1 −7 crd-chart/templates/mission-control.flanksource.com_notifications.yaml
+1 −1 crd-chart/templates/mission-control.flanksource.com_notificationsilences.yaml
+1 −1 crd-chart/templates/mission-control.flanksource.com_permissiongroups.yaml
+30 −6 crd-chart/templates/mission-control.flanksource.com_permissions.yaml
+634 −9 crd-chart/templates/mission-control.flanksource.com_playbooks.yaml
+273 −0 crd-chart/templates/mission-control.flanksource.com_scopes.yaml
+1,095 −0 crd-chart/templates/mission-control.flanksource.com_views.yaml
Loading