How do you setup flyte for multi-tenancy and is there a way to have tenant specific storage secrets?

It seems likely that Flyte supports multi-tenancy using projects and domains, which allow for environment isolation and separation of concerns. Each project/domain can be mapped to a different team or tenant, and Flyte's architecture is designed to enable this kind of segmentation without replicating management infrastructure. This is described in From Incubation to Graduation and Beyond. For tenant-specific storage secrets, my understanding is that Flyte can use Kubernetes secrets or external secret managers (like AWS Secrets Manager or Vault) scoped to specific namespaces (which typically correspond to project-domain pairs). You can create secrets in the namespace for a given project/domain and Flyte will mount or inject them only for executions in that namespace, enabling tenant-specific secret isolation. This is supported by the Flyte secrets mechanism as described in Flyte's documentation on secret management and Union.ai Docs: Secrets. Would you like more detail on the exact steps for configuring multi-tenancy and per-tenant storage secrets? Sources: - Flyte's documentation on secret management - Union.ai Docs: Secrets - From Incubation to Graduation and Beyond 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 there seems to be a single blob storage secret shared by all flyte components though. How does that work with multitenancy?

By default, Flyte's core storage (e.g., S3, GCS, Azure Blob) is configured with a single set of credentials (secret) shared by all Flyte components, which means all tenants (projects/domains) use the same storage access. This is a limitation for strict tenant isolation, as the storage secret is not natively scoped per tenant—it's typically mounted cluster-wide or per deployment, not per project/domain. This is confirmed in Flyte's documentation on secret management and related GitHub issues, which note that storage secrets are usually set globally and not per-tenant. For stricter isolation, some users deploy separate Flyte environments (clusters) per tenant, each with its own storage secret, but Flyte does not currently support per-tenant storage secrets within a single deployment out of the box. There are open discussions and feature requests about this limitation, but as of now, tenant-specific storage secrets are not natively supported in a single Flyte deployment (GitHub Issue #5189, GitHub Issue #6394). Would you like more detail on possible workarounds or the current state of feature requests for this capability? Sources: - GitHub Issue #5189: Flyte Project isolation - Flyte's documentation on secret management - GitHub Issue #6394 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.