User group management

[paterczm]

Authorize users to manage resources in a given namespace(s) in Turbonomic UI using Kubernetive native apis. Assume groups are coming from SSO integration.

[paterczm]

Design draft:

[atzgg132]

To help implement namespace-based authorization using Kubernetes RBAC and SSO groups, I need a bit more info:
Where should the authorization logic live? (Operator, backend, webhook, or UI?)
How does Turbonomic currently get user/group info from SSO? Is it available in the session/context?
Should the UI/backend expose a new API for allowed namespaces, or should the operator/controller enforce this directly?
Are we using only Kubernetes-native RBAC for mapping groups to namespaces, or is there a custom mapping/config?