[Forwardport 1.x] For read-only tenants filter with allow list (#3529)

[Forwardport 1.x] For read-only tenants filter with allow list (#3529) #559