From Chaos To Control: Migrating Access Control To OpenFGA in a Multi-Tenant World
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 15:15· Level 1 | Hall Entrance N10 | Room G·
summary
Grafana migrates its legacy access control to OpenFGA, starting with folders and dashboards and using per-tenant stores to avoid cross-tenant leaks and reduce latency by running one OpenFGA per cluster. Key lessons: tuple volume and schema complexity hurt performance, SQLite/MySQL/Postgres backends differ, use shadow calls and repeated verification during migrations, and prefer search-and-check for small result sets but switch to a local index or aggressive tenant filtering when listings exceed ~1000 objects. Packaging uses Grafana DSkit and an offlib client for easy deployment.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:29Need for standard auth
- 5:20Zanzibar and OpenFGA
- 7:07Declarative auth with OpenFGA
- 10:56Grafana’s access control issues
- 13:27Opportunity with Grafana platform
- 15:56Migrating in three steps
- 18:04Schema design pitfalls
- 19:29Multi-tenancy with OpenFGA
- 21:14Safe migration strategies
- 22:59Permissions at scale
- 25:50Search strategies for tenants
- 26:56Packaging auth logic
- 28:20Q&A
related talks
25mImplementing Modern Cloud Native Authorization Using OpenFGA
40mImplementing a Multi-Tenant, Relationship-Based Authorizatio...
54mFine-Grained Authorization for Modern Applications
25mModernizing Authorization for Cloud Native Applications Using OpenFGA
37mRole-Based Access Is so Yesterday: Revolutionizing Authorization with Open FGA
33mFine-Grained Policies RBAC with OpenFGA
19mKeep Storing and Carry On- 33mFine-Grained Policies RBAC with OpenFGA