Problem with policies

[gustavodutra]

Hi everyone,

How are you?

I received a request where users from another company want access to the Dynatrace configurations in clusters for which they are not responsible for the development.

In order not to expose all my configurations and permissions, I created rules based on schemaId and schemaGroup for a group and assigned them to the users.

However, I'm facing an issue with the Kubernetes visualization (new version). In Kubernetes Classic it works perfectly, but in the new version of Kubernetes, they are unable to view their clusters, namespaces, workloads, nodes, pods, etc. It only works in the Classic version.

I found that when I specify this rule inside the policies:

ALLOW storage:entities:read;

They are able to see the clusters, namespaces, etc., but they are seeing all the clusters in the environment.

Is there a way to define this rule only for the cluster they are responsible for and hide mine?

[gustavodutra]

[gustavodutra]

It works like that without the mentioned rule, but once the rule is included, they can see everything.

[Julius_Loman · Accepted solution]

You need to set the boundaries for permission. You can do that either by creating a boundary and using it with the policy when you create a permission, or you can do it directly in the permission by specifying the security context.