Motivation
VPC operations (creating VPCs, attaching workloads, modifying routes) need proper authorization. Without IAM integration, there is no way to control who can modify network configuration — any authenticated user could change any VPC.
Scope
- Define IAM roles for VPC resources: admin, editor, viewer
- Implement PolicyBindings for VPC, VPCAttachment, and Route resources
- Enforce authorization at the API server admission layer
- Support scoping permissions to specific VPCs (not just all-or-nothing)
- Integrate with the platform's existing IAM ProtectedResource model
Parent
Sub-issue of datum-cloud/enhancements#594
Motivation
VPC operations (creating VPCs, attaching workloads, modifying routes) need proper authorization. Without IAM integration, there is no way to control who can modify network configuration — any authenticated user could change any VPC.
Scope
Parent
Sub-issue of datum-cloud/enhancements#594