Proposal
Alertmanager is effectively a multi-tenant piece of software. However, it has no mechanism for authorization requests.
For API v3 (and Alertmanager 1.0) we should develop a mechanism for authentication and authorization of requests. Most likely, authorization can be offloaded to an authorization webhook so that users can provide their own policy engines.
The idea is to have something similar to K8s authorization webhooks: https://kubernetes.io/docs/reference/access-authn-authz/webhook/
Proposal
Alertmanager is effectively a multi-tenant piece of software. However, it has no mechanism for authorization requests.
For API v3 (and Alertmanager 1.0) we should develop a mechanism for authentication and authorization of requests. Most likely, authorization can be offloaded to an authorization webhook so that users can provide their own policy engines.
The idea is to have something similar to K8s authorization webhooks: https://kubernetes.io/docs/reference/access-authn-authz/webhook/