Multi-Tenancy for Logs

[Rotfuks]

Motivation

Logs tend to have sensitive information in them - especially when we want to cover customer workloads this might include endusers gdpr relevant data. For this we have to make sure there is a basic data isolation in Loki and we can control who sees which set of logs based on a specific tenant.

Investigation

Preview Give feedback

1. Investigation for Loki Multi Tenancy #3559
   team/atlas +1
   
2. Investigate OrganisationCR #3693
   team/atlas +1
   

Implementation

Preview Give feedback

1. Extend O11yOp with Org-Controller #3695
   team/atlas +1
   
2. Migrate Dashboards into Tenants #3696
   blocked team/atlas +2
   
3. Align grafana org-based multi-tenancy with loki tenants - Investigation #3726
   blocked needs/refinement team/atlas +3
   
4. https://github.com/giantswarm/giantswarm/issues/29074
5. Allow fine grained access to our central grafana #1572
   component/grafana team/atlas topic/observability +3
6. Multi-tenancy Documentation #3694
   team/atlas +1
   
7. Multi-Tenants Datasource #3784
   team/atlas +1
8. Present the Organisation CR to Grafana Community #3697
   team/atlas +1
9. https://github.com/giantswarm/giantswarm/issues/25198
10. grafana multi-org and dashboard links #3826
    team/atlas +1
    

Outcome

• We have basic data isolation and customers can control which group of users can access what set of logs in our observability platform.