Multi-tenancy
This content is for 0.1.0. Switch to the latest version for up-to-date documentation.
FleetOrg and console roles model organization-scoped access to sites, clusters,
and catalog instances. This capability is experimental; it does not provide a
production tenancy, isolation, quota, or compliance guarantee.
| Role | Intended scope |
|---|---|
dc-admin |
Platform administration |
org-admin |
One organization and its assigned resources |
customer |
Restricted organization-scoped workload operations |
The console auth proxy derives and forwards trusted identity assertions after
authentication. Clients must not supply or forge X-Fleet-Subject-* headers
to obtain a scope. Independently validate all access boundaries before using
this feature with sensitive workloads.