[GitHub] [airflow] isaac-florence commented on issue #19226: DAG permission setting per owner and/or per tag

[GitBox <gi...@apache.org>]

isaac-florence commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-988324455


   Agreeing with @potiuk's comment on #9342, airflow can't do multi-tenancy at the moment. However we have setup an instance which only uses the kubernetesPodOperator, and so can have multiple tenants coexisting where each tenant has their own k8s namespace/openshift project.  
   This model does require a central technician "approve" DAGs and merge requests to a dag repo to ensure that each tenant's dags only refer to their own project.
   A further improvement of that model would be the implementation of this issue so that dags can be added to roles/groups based on their tag (or something else similar, like the owner), rather than the central technician adding dags to the tenant's role!
   This does create literal security at the cost of staff time in reviewing dags/dag changes and time-to-deployment of new dags to be approved!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org