I know that through the ingress on k8s we can have a OAuth2 proxy in front of it, we do that for Airflow already, but some internal RBAC would be interesting as well, as we have some people in the team that would need only Viewer access for example, to for example only check the logs of the syncs / jobs, and not change anything (as we do in Airflow now as well).