Has anyone had success with deploying Flyte in a multi-tenant environment? We are looking for ways to isolate customer workloads. I understand that Flyte wasn't designed for this but perhaps there are workarounds.

what do you mean?

We are a SaaS company and workflows are part of our offering. Flyte checks most of our boxes but doesn't have first-class support for isolating users from one another: our users must not be able to see or manipulate any other user's projects and domains, and their k8s pods must not be able to access each other's blob storage.

This is pretty complicated, how can you prevent users for accessing each others storage. You will share creds

Btw you folks should consider union

That's unfortunately not an option, for several reasons.

We have OSS flyte setup in a multi-tenant fashion. We have different projects, and then we have base pod templates in each tenant namespace which load tenant specific credentials. We use a custom RBAC implementation to isolate users from messing with other projects as well: https://github.com/flyteorg/flyte/pull/6190

Thanks @clean-glass-36808, sounds very similar to what we ended up doing. Our current thinking is that each customer gets their own project. We then use customer-specific pod templates that define the customer's S3 bucket and service account. The IAM role tied to the service account grants full access to the customer-specific data bucket and partial access to the global metadata bucket.

The RBAC implementation we have solves the UI issue for us by filtering our projects