Project Management

Project

General

A project is a type of tenant used to implement resource isolation and user permission management. After a user joins a project, the user can have view or operation permissions on the resources of the project.

After a user joins a project, the user has the permissions to view and manage the resources under the project.
All the resources created by a user under the current project belong to this project.
Different users under the same project can view the same resources, while the resources of different projects are isolated from each other.
The users who belong to the same team or have the same function can be added to the same project, which ensures clear permissions between different teams and prevents resources from interfering with each other, and guarantees the security and confidentiality of the project data.

Creating a Project

In the ZStack Zaku main menu, click Cluster Management > Project Management > Project to enter the Project page. Click Create Project and the Create Project page is displayed.

You can refer to the following example to enter the required information:

Name: set the name of the project. Naming rules: the length is limited to 1 to 128 characters, and the input can contain only Chinese characters, English letters, digits and the following 7 characters: (-) (_) (.) (() ()) (:) (+).
Description: optional. Add the information related to the project.

Managing Projects

In the ZStack Zaku main menu, click Cluster Management > Project Management > Project to enter the Project page.

Projects support the following operations:

Operation	Description
Create Project	Create a new project.
Edit Project	Edit the name and the description of the project.
Add Member	Add existing users to the current project and assign permissions to them. Two types of permissions, read-only and read-write, are supported: Read-only: the users are allowed to view the resources under the current project. Read-write: the users are allowed to view and operate the resources under the current project, including creating, modifying and deleting. Note: Up to 50 members can be added at a time.
Remove Member	Remove the user from the project. After the removal, the user no longer has the permissions to view and manage the resources under the project.
Add Namespace	Add a namespace to the current project, so that the project members can view and manage the resources under the namespace. The members with the read-only permission can view the resources under the namespace. The members with the read-write permission can view and operate the resources under the namespace, including creating, modifying and deleting. Note: Multiple namespaces can be added to a project, while a namespace can be added to only one project.
Remove Namespace	Remove the namespace from the project. After the removal, the project members no longer have the permissions to view and manage the resources under the namespace.
Delete Project	Delete the project. Note: A project cannot be deleted when the following resources exist under it: repositories, namespaces and endpoints. Deleting a project removes all the members in the project, and deletes the templates and the alarms under the project at the same time. Perform this operation with caution.

User

General

The users of ZStack Zaku include local users and third-party users:

Local user: a user created on the platform. The following operations are supported: enabling, disabling, resetting the password, setting as an administrator, canceling the administrator role and joining a project.
Third-party user: a user synchronized to the platform through third-party authentication. The following operations are supported: setting as an administrator, canceling the administrator role and joining a project.

User Permissions

Users have different permissions according to their roles. There are three roles in total: super administrator, administrator and regular user:

admin: the super administrator, who has all the permissions of the platform.
Administrator: the admin user can set a user as an administrator, and then the user has the administrator permissions. An administrator has all the other permissions of the platform except managing other administrators and third-party authentication.
Regular user: a regular user has the platform permissions only after joining a project.
- A regular user has the operation permissions on the following functional modules and resources:
  - Container orchestration
  - Artifact repository
  - Container O&M
- A regular user does not have the operation permissions on the following platform-level functional modules or resources:
  - Cluster management
  - Settings
  Note: Although a regular user does not have the management permissions on external networks, the user can use the external network resources shared globally by the admin user or shared with the project the user belongs to.
- The permissions of a regular user on specific resources are determined by the projects the user has joined and the namespaces of the projects:
  - Project: a regular user can view and manage the resources under the projects the user has joined. A project can assign the read-only permission or the read-write permission on the resources to a regular user.
    - Read-only permission: the regular user is allowed only to view the resources under the project.
    - Read-write permission: the regular user is allowed to view and operate the resources under the project, including creating, modifying and deleting.
  - Namespace: a regular user can view and manage the resources in the namespaces under the projects the user has joined.
    - If the project has assigned the read-only permission to the regular user, the regular user can view the resources in the namespaces.
    - If the project has assigned the read-write permission to the regular user, the regular user can view and operate the resources in the namespaces
      , including creating, deleting and modifying.

Creating a Local User

In the ZStack Zaku main menu, click Cluster Management > Project Management > User to enter the User page. Click Create User to enter the Create User page.

You can refer to the following example to enter the required information:

Username: set the name of the user. Naming rules: the length is limited to 2 to 30 characters, and the input can contain only lowercase letters, digits and the special characters (_) (-). It must start with a letter.
Description: optional. Add the information related to the user.
Password: set the password of the user. Password rules: the length is limited to 8 to 32 characters, and the password must contain at least 3 of the following: uppercase letters, lowercase letters, digits and special characters.
Confirm Password: confirm the password of the user again.
Project: select the projects the user joins and set the permissions for the user. A user has no permission by default, and has the permissions on the resources under a project only after joining the project. A user can join multiple projects.
- Read-only permission: the user is allowed only to view the resources under the project.
- Read-write permission: the user is allowed to view and operate the resources under the project, including creating, modifying and deleting.

Managing Users

Managing Local Users

In the ZStack Zaku main menu, click Cluster Management > Project Management > User to enter the Local User page.

Local users support the following operations:

Operation	Description
Create User	Create a new user.
Disable User	Disable the user. After the user is disabled, the user cannot log in to the platform.
Enable User	Enable the user. After the user is enabled, the user can log in to the platform normally.
Reset Password	Reset the password of the user. The old password does not need to be verified during the reset.
Set as Administrator	Set the user as an administrator. An administrator has all the other permissions of the platform except managing other administrators and third-party authentication.
Cancel Administrator	Cancel the administrator role of the user, and all the permissions of the user are canceled.
Add Project	Add the user to one or more projects.
Remove from Project	Remove the user from the projects the user has joined.
Modify Permission Configuration	Modify the permission configuration of the user in a project.
User Details	Enter the user details page to view the basic information of the user and the projects the user has joined.
Delete User	Delete the user. When the user is deleted, all the permissions of the user are revoked at the same time.

Managing Third-Party Users

In the ZStack Zaku main menu, click Cluster Management > Project Management > User to enter the Third-Party User page.

Third-party users support the following operations:

Operation	Description
Set as Administrator	Set the user as an administrator. An administrator has all the other permissions of the platform except managing other administrators and third-party authentication.
Cancel Administrator	Cancel the administrator role of the user, and all the permissions of the user are canceled.
Add Project	Add the user to one or more projects.
Remove from Project	Remove the user from the projects the user has joined.
Modify Permission	Modify the permission configuration of the user in a project.
User Details	Enter the user details page to view the basic information of the user and the projects the user has joined.
Delete User	Delete the user. When the user is deleted, all the permissions of the user are revoked at the same time. Note: After a third-party user is deleted, if the user is not deleted in the third-party authentication center, the platform synchronizes and creates the user again when the user logs in to the platform again.

Namespace

General

A namespace provides virtual isolation for a Kubernetes cluster. Resources in different namespaces are isolated from each other.

A namespace has the following characteristics:

Resource Isolation and Permission Control

Resource isolation: you can create multiple namespaces according to the business requirements, and different namespaces manage the resources for different purposes, which achieves effective allocation of workspaces. For example, the resources of the development environment, the test environment and the joint debugging environment are placed under different namespaces respectively.
Permission control: a namespace can be assigned to a project, so that the members under the project can view and manage the resources under the namespace. A namespace can be assigned to only one project at the same time. Except for the members under this project and the administrators, other users cannot view or manage this namespace.
Note: When a namespace has not joined any project, the Kubernetes resources under this namespace cannot be viewed or managed.

Resource Usage Control

You can set resource quotas for a namespace. When cluster resources are shared by multiple teams or multiple users, the resource usage can be controlled effectively in this way.

The following resource quotas can be set. When the corresponding resources in a namespace exceed the quotas set, new resources cannot be created, while the existing resources are not affected:

CPU request quota: the upper limit of the total CPU requests of all the pods under this namespace. If it is not set, there is no limit by default.
CPU limit quota: the upper limit of the total CPU limits of all the pods under this namespace. If it is not set, there is no limit by default.
Memory request quota: the upper limit of the total memory requests of all the pods under this namespace. If it is not set, there is no limit by default.
Memory limit quota: the upper limit of the total memory limits of all the pods under this namespace. If it is not set, there is no limit by default.
PVC capacity quota: the upper limit of the total capacity of the PVCs that can be created under this namespace. If it is not set, there is no limit by default.
Pod quota: the upper limit of the total number of the pods that can be created under this namespace. If it is not set, there is no limit by default.
Service quota: the upper limit of the total number of the services that can be created under this namespace. If it is not set, there is no limit by default.
LoadBalancer service quota: the upper limit of the total number of the LoadBalancer services that can be created under this namespace. If it is not set, there is no limit by default.
Note: A LoadBalancer service is a type of service, so the LoadBalancer service quota cannot exceed the service quota.
ConfigMap quota: the upper limit of the total number of the ConfigMaps that can be created under this namespace. If it is not set, there is no limit by default.
Secret quota: the upper limit of the total number of the Secrets that can be created under this namespace. If it is not set, there is no limit by default.
GPU memory quota: the total GPU memory of the corresponding manufacturer that can be used under this namespace. If it is not set, there is no limit by default. There is no limit for the manufacturers that are not set by default.

Note: If a CPU/memory resource quota is set for a namespace, the CPU/memory limits of a pod must be specified when the pod is created under this namespace. You can also set the default CPU/memory limits for a namespace, and then a pod uses these CPU/memory limits by default when it is created under this namespace.

Creating a Namespace

In the ZStack Zaku main menu, click Cluster Management > Project Management > Namespace to enter the Namespace page. Click Create Namespace and the Create Namespace page is displayed.

You can refer to the following example to enter the required information:

Name: set the name of the namespace. Naming rules: the length is limited to 1 to 50 characters, and the input can contain only lowercase letters, digits and the separator (-). It must start with a lowercase letter and end with a digit or a lowercase letter.
Project: add the namespace to a project, so that the project members are allowed to view and manage the Kubernetes resources under this namespace.
Note: If it is not specified manually, the namespace is added to the default project.
Label: add labels to the namespace in the form of key/value pairs.
- Key: enter the label key.
  Note:
  - Usually the key can contain 1-63 characters, including letters, digits and the following special characters: (-)(_)(.). The special characters cannot be used at the beginning or the end of the key.
  - A prefix can be added before the key and connected to the key with /, for example k8s.io/app. All the characters before / are considered the key prefix, and all the characters after / are considered the key.
  - The key prefix can contain 1-253 characters, including lowercase letters, digits and the following special characters: (-)(.). Two or more special characters cannot be used consecutively, and special characters cannot be used at the beginning or the end of the prefix.
  - Note that you do not have to use a key prefix, but the key is required.
- Value: enter the label value.
Annotation: add annotations to the namespace in the form of key/value pairs.
- Key: enter the annotation key.
  Note:
  - Usually the key can contain 1-63 characters, including letters, digits and the following special characters: (-)(_)(.). The special characters cannot be used at the beginning or the end of the key.
  - A prefix can be added before the key and connected to the key with /, for example k8s.io/app. All the characters before / are considered the key prefix, and all the characters after / are considered the key.
  - The key prefix can contain 1-253 characters, including lowercase letters, digits and the following special characters: (-)(.). Two or more special characters cannot be used consecutively, and special characters cannot be used at the beginning or the end of the prefix.
  - Note that you do not have to use a key prefix, but the key is required.
- Value: enter the annotation value.

Managing Namespaces

In the ZStack Zaku main menu, click Cluster Management > Project Management > Namespace to enter the Namespace page.

Namespaces support the following operations:

Operation	Description
Create Namespace	Create a namespace under a cluster.
Set Resource Quota	Set resource quotas for the namespace. After the quotas are set, the number of the resources created/used under this namespace cannot exceed the quotas.
Set Default Resource Limits	Set the default CPU/memory resource limits of the pods under the namespace. After they are set, the pods created under this namespace use these CPU/memory limits by default.
Join Project	Add the namespace to a project, so that the project members are allowed to view and manage the Kubernetes resources under this namespace: The project members with the read-only permission can view the Kubernetes resources under this namespace. The project members with the read-write permission can view, create, modify or delete the Kubernetes resources under this namespace.
Remove from Project	Remove the namespace from the project. After the removal, the members of the original project can no longer view or manage the Kubernetes resources under this namespace. Note: When a namespace does not belong to any project, the Kubernetes resources under this namespace cannot be viewed or managed.
Edit Label and Annotation	Edit the labels and the annotations of the namespace.
Namespace Details	Enter the namespace details page to view the basic information of the namespace.
Delete Namespace	Remove the namespace from the cluster. Note: This operation deletes all the resources under the current namespace at the same time. Perform this operation with caution.

PreviousNetwork Management NextSettings