HN user

miravmehta

3 karma

Building Software and Products since 7 years in realm of Security, Infrastructure and Platform

Posts0
Comments18
View on HN
No posts found.

Location : Canada

Remote: Yes, Hybrid, or Onsite

Résumé/CV: available upon request

Email : mirav.mailme@gmail.com

Linkedin : https://www.linkedin.com/in/miravtmehta/

Technical Product Manager at a Fortune 50 company with 8.5 years of experience, focused on Code-to-Cloud Security products. My expertise spans Network Infrastructure, Data/ETL Pipelines, and Cloud Security. Previously as Lead software developer, I drove product development for data intensive platforms, including a Kubernetes operations platform and a semantic search engine (web3.0) at high-growth Series A/B/C startups.

  Location: Bangalore, India
  Remote: Yes (IST Time Zone)
  Willing to relocate: Yes + Canadian PR Holder
  Linkedin: https://www.linkedin.com/in/miravtmehta/
  Email: mirav.mailme[AT]gmail.com


  Technologies:
    - Golang, Kubernetes, Docker, Flask, Django, Python
    - AWS, GCP, Kafka streaming, Security Compliance, CSPM-KSPM-CIEM
 
  Product Skill: Competitive Analysis, Scrum, Pricing, RoadMaps, PRD's, Mathematical Modelling

.. Total 7 YoE, Previously lead software engineer building cloud apps. Currently Technical Product Manager (TPM) building platform powered by semantic web (web 3.0) around institutional data, infrastructure and security, also leading at team of 7 full stack engineers and data scientists to build custom LLM models.

Looking out for next stint for TPM roles.

[1] MSP is the term for this. Managed Service Provider Lets say my company has a SaaS product. AT&T is the customer to my company and i onboard them to my SaaS platform, now AT&T has a customer called "Dell" and AT&T wants to onboard Dell to this platform ; Essentially white-labelling

Parent- AT&T Child - AT&T

[2] We have SaaS platform build like Backstage, Vmware Tanzu. We didn't wanted to build custom auth solution, this was a demand from customers who wanted granularity not just based on CRUD operations but based on environments, access to type of metadata, projects, other app-services

We had something called soft-multi-tenancy, where user "abc" can access namespace in k8s in cluster B, but not cluster A; because B (child) is inherited cluster from A (parent)

Examples of RBAC granularity

1. Write access to Namespace (can change, Namespace, pods, deployment and more .. based on k8s first class object) 2. Read access to Namespace 3. Write access to Pods 4. Read access to Pods

Just like this we had close to 20 RBAC granularity

I recommend you reading about RBAC, ABAC, RE-BAC, Soft Multi-tenancy ; companies who are building this loft.sh, rancher. Our solution was not focused RBAC at all, when we bough multi-tenancy it enforced us think through RBAC

Sure, here are the corrected sentences:

1. RBAC Policy When there are multiple types of roles in a parent-tenant (pt) and child-tenant (ct), there could be cases where some resources can be shared between pt and ct, while others cannot. Hence, conditions to access these data are not limited to RBAC, but also depend on the type of data and metadata. Checks are applied on metadata.

2. Architecting Multi-Tenant A significant challenge would be in schema design, especially the isolation of pt and ct. There are open-source solutions available that provide pre-cooked solutions, yet they may not be as effective as writing your own.

3. RBAC can go beyond ABAC and REBAC This is an advanced problem. Customers in the cloud-native space have demanded this before as it provides granularity. This is heavily backed by your RBAC architecture. If that's implemented incorrectly, then your ABAC and REBAC will also be affected.