Understanding Feature Flag Scopes in Tanzu Platform for Cloud Foundry
Article ID: 448754
Updated On:
Products
Issue/Introduction
Feature Flags are Read only from Tanzu Hub UI, Platform teams and Application developers often seek ways to view, manage, or toggle feature flags specifically scoped to an Organization (Org) or a Space within Tanzu Platform for Cloud Foundry or Tanzu Application Service (TAS).
Environment
Tanzu Platform for Cloud Foundry
Tanzu Application Service
Elastic Application Runtime
Cause
Tanzu Hub simply allows users to select a foundation to view its associated feature flags. They cannot do any modifications like Enable/Disable because its Foundation scoped and not at specific Org/Space.
Resolution
This is as per the design, only admin can enable/disable Feature flags using the cf cli as described here https://docs.cloudfoundry.org/adminguide/listing-feature-flags.html and that also at the entire Foundation level not at the individual Org/Scope level.
If there is a strict requirement to restrict or allow behaviors locally at the Org or Space level, you must utilize native Cloud Foundry mechanisms designed for localized tenant isolation rather than feature flags:
Quotas: Use quotas to control resource limits (memory, app instances, routes, paid services) independently at both the Org and Space levels.
Application Security Groups (ASGs): Bind network access rules explicitly to individual Spaces to restrict or allow specific egress traffic for particular tenants, rather than applying them globally.
Isolation Segments: Entitle specific Orgs to dedicated compute resources, keeping workloads physically separated on different Diego cells.
Feature flags dictate what roles are permitted to do across the platform globally. Quotas, ASGs, and Isolation Segments dictate where and how much they are permitted to do it locally.
Feedback
