Epic Goal

...

Goal for ACM 2.16 is at least to have a ready to implement plan to achieve:

• Fine-Grained RBAC for metrics
• Multitenancy for MultiClusterLogging.

It is not expectation to have a customer facing solution (maybe Dev-Preview), but we should be able to implement plan for ACM 2.17

This is a summary of current plan

1. ObservabilityAddonRole CRD: A new custom resource, ObservabilityAddonRole, is introduced to define fine-grained permissions. This CRD specifies:

• • Actions: Which signals and access types are allowed (e.g., "metrics:read", "logs:read").

• • Scopes: The specific resources the actions apply to, defined using label-based filtering (e.g., cluster="managed-cluster-1", namespace="stage"). The syntax for filtering is based on the query language for the signal (PromQL for metrics, LogQL for logs, etc.).

2- ClusterRole Mapping: The standard Kubernetes ClusterRole will no longer define the specific metric access directly. Instead, it will simply point to a corresponding ObservabilityAddonRole using a {{}}

3. Authorization: The Observatorium API will enforce these label-based filters on incoming requests, ensuring users only see data they are permitted to access across all observability signals.

4. long term the solution will be open for KesselSpiceDB-Integration, but would not block neither DP/TP and likely not GA

Why is this important?

it blocks multicluster-logging and fine-grained rbac for metrics

Scenarios

...

Acceptance Criteria

...

Dependencies (internal and external)

1. ...

Previous Work (Optional):

1. ...

Open questions:

1. …

Done Checklist

• CI - CI is running, tests are automated and merged.
• Release Enablement <link to Feature Enablement Presentation>
• DEV - Upstream code and tests merged: <link to meaningful PR or GitHub
  Issue>
• DEV - Upstream documentation merged: <link to meaningful PR or GitHub
  Issue>
• DEV - Downstream build attached to advisory: <link to errata>
• QE - Test plans in Polarion: <link or reference to Polarion>
• QE - Automated tests merged: <link or reference to automated tests>
• DOC - Doc issue opened with a completed template. Separate doc issue
  opened for any deprecation, removal, or any current known
  issue/troubleshooting removal from the doc, if applicable.