You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pinot.apache.org by GitBox <gi...@apache.org> on 2021/07/08 04:41:12 UTC
[GitHub] [incubator-pinot] mayankshriv opened a new issue #7138: Support for Tenant data isolation
mayankshriv opened a new issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138
We have seen requirements where multiple tenants (clients) need to be hosted on the same Pinot table (one table per client is not scalable). However, the tenants would like to ensure that their data is isolated from other tenants' data on the Pinot table. Isolation here means:
- Guarantee that a client's (tenant) data is protected against any leaks (accidental or otherwise) to other clients.
- Certain use cases may also require tenant/client specific encryption keys to further ensure data isolation
(Note tenant and client are used here interchangeably).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [incubator-pinot] yupeng9 commented on issue #7138: Support for Tenant data isolation
Posted by GitBox <gi...@apache.org>.
yupeng9 commented on issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138#issuecomment-876614275
+1 to this, and we see similar asks at Uber. Also, we could start with removing the constraint that a table name is unique in a cluster, but allow the tenant name as the namespace. So we can have the same table name in different tenants.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [incubator-pinot] johighley commented on issue #7138: Support for Tenant data isolation
Posted by GitBox <gi...@apache.org>.
johighley commented on issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138#issuecomment-876601274
I _think_ it would be a separate physical table. Table configuration could be the same; basically, the table's broker and server tenant tags would allow a list of tenants instead of just one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [incubator-pinot] kishoreg commented on issue #7138: Support for Tenant data isolation
Posted by GitBox <gi...@apache.org>.
kishoreg commented on issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138#issuecomment-876597332
> We need the ability for each tenant to have the same set of tables without requiring unique table names.
what about the data across tenants? will there be a separate physical table for each client
I am trying to understand if your requirement boils down to have a distinction between physical and logical table names
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [incubator-pinot] LiranBri commented on issue #7138: Support for Tenant data isolation
Posted by GitBox <gi...@apache.org>.
LiranBri commented on issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138#issuecomment-876457359
We would highly appreciate such an ability!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [incubator-pinot] johighley edited a comment on issue #7138: Support for Tenant data isolation
Posted by GitBox <gi...@apache.org>.
johighley edited a comment on issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138#issuecomment-876556994
Mayank created this request after our Slack conversation, so to expand the use case: We have a lot of clients (tenants) and require data separation. Each client will have the same set of tables (ex: customer, account). We need the ability for each tenant to have the same set of tables without requiring unique table names.
Some way to indicate the tenant for operations would be needed: select * from TenentA.accounts; for example
It would also be helpful if brokers and servers could host multiple tenants. Otherwise, the number of brokers and servers needed (with redundancy) grows very quickly.
I think the disconnect may be that Pinot sees tenants as being different applications, each with distinct table names. Many use cases, though, treat tenants as different clients, all using the same application. Each client needs the same set of application tables but the tables need to be separated when data can't be co-mingled across clients.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [incubator-pinot] johighley commented on issue #7138: Support for Tenant data isolation
Posted by GitBox <gi...@apache.org>.
johighley commented on issue #7138:
URL: https://github.com/apache/incubator-pinot/issues/7138#issuecomment-876556994
Mayank created this request after our Slack conversation, so to expand the use case: We have a lot of clients (tenants) and require data separation. Each client will have the same set of tables (ex: customer, account). We need the ability for each tenant to have the same set of tables without requiring unique table names.
Some way to indicate the tenant for operations would be needed: select * from TenentA.accounts; for example
It would also be helpful if brokers and servers could host multiple tenants. Otherwise, the number of brokers and servers needed (with redundancy) grows very quickly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org