If you want it obscured, then options 1 and 2 cannot achieve that with the regular client. Could still be achieved if you plan to wrap the client into a layer which handles the indirection, but it might get complicated...?

Alternatively, we could perhaps have a store config which is essentially "topicPrefix" and all of the components would need to honor that when crafting topic names. It would be a somewhat complicated refactoring, but maybe cleaner in the end. WDYT?

Also: is it acceptable for this store-tenant mapping to be immutable? Or do you expect it to be mutable?

so tenant1 -> store1 is different from tenant2 -> store1

I have a POC in which I allow the storeName to be in the form tenant.namespace.name from the Venice point of view the space of the names of the stores is still flat, there is no hierarchy

but on Pulsar I store the data on topics named like tenant/namespace/store_v1….. and this means that the data of each “tenant/namespace” is logically isolated

I would like to implement authorisation in a way that a “tenant” can access only stores whose name starts with “tenant.” or something like that. I saw that there is some ACL/permissions support in Venice, but I want something that is more strong and not error prone

This is my current patch https://github.com/datastax/venice/pull/2