Limiting imports across namespaces

Ask the Community
1

I have a number of namespaces in my environment, dev, qa, prod, etc. I would like to set up my environment so resources can be imported between projects within a single namespace but cannot be imported between namespaces. I don’t want dev data to end up in prod for example.

How can I best accomplish this?

2

hey.

i think the best way to do this is using markings. if you,

  1. apply a distinct marking on each namespace that all users have access to,
  2. apply a marking constraint to every project which denies the markings for other namespaces.

then the marking on the namespaces inherit down to datasets contained, and importing the dataset into a different namespace would violate the marking constraint and throw.

to apply a marking to a namespace you’ll need to curl the compass updateResourceMarkings endpoint directly probably, and for marking constraints on projects you can configure this in project templates for newly created projects, and configure in the UI or in a script through updateProject for existing projects.

let me know if that makes sense

angus

3

Concepts • Organizations and spaces • Palantir

Concepts • Projects and roles • Palantir