Domain vs Namespace

[taoj-action]

Conductor does have a concept of Domains. From its documentation, it seems to be only used as a non-production uses cases. It is unclear whether it could eventually become a building block for tenant isolation.

On the other hand, Temporal teats Domain much more seriously and it changes Domain into Namespace and uses it as the fundamental unit of isolation.

Even though Namespace/Domain may not be flexible enough for all needs as pointed out by Kubernetes hierarchical namespace proposal, it is a good start from a security and compliance aspect. We could build per namespace-based resource quota, etc later.

Our internal patch on Conductor does add Namespace in addition to Domain. However, I often feel they are pretty much the same and could be combined. We would like to implement or help to implement the Tenant isolation as part of the roadmap. However, we do need to start with a unified concept. Thanks!

[aravindanr]

Thanks for starting this discussion. Agree with your point about Domains. For what its worth, domain was introduced to support testing rather than tenant isolation (multi-tenancy). In a shared Conductor environment (live production traffic and developer traffic), where a task is getting updated, domains allow a worker on a developer's workstation to NOT pick tasks from the live production workflows.

Please share your proposal for adding namespaces and tenant isolation. So we can discuss further.

[aravindanr]

@taojwmware We would like to know more about Conductor users. As a start, we are gathering who is using Conductor. Appreciate if you can send a PR containing your company information in WHOSUSING.md.

[taoj-action]

@taojwmware We would like to know more about Conductor users. As a start, we are gathering who is using Conductor. Appreciate if you can send a PR containing your company information in WHOSUSING.md.

done. #2721