Overview

A project allows a community of users to organize and manage their content in isolation from other communities.

Creating a Project

If allowed , you can create a new project using the CLI or the web console.

To create a new project using the CLI:

$ oc new-project <project_name> \
    --description="<description>" --display-name="<display_name>"

For example:

$ oc new-project hello-openshift \
    --description="This is an example project to demonstrate OpenShift v3" \
    --display-name="Hello OpenShift"

The number of projects you are allowed to create is limited. Once your limit is reached, you may need to delete an existing project in order to create a new one.

Viewing Projects

When viewing projects, you are restricted to seeing only the projects you have access to view based on the authorization policy.

To view a list of projects:

$ oc get projects

You can change from the current project to a different project for CLI operations. The specified project is then used in all subsequent operations that manipulate project-scoped content:

$ oc project <project_name>

You can also use the web console to view and change between projects. After authenticating and logging in, you are presented with a list of projects that you have access to:

Projects Page

If you use the CLI to create a new project, you can then refresh the page in the browser to see the new project.

Selecting a project brings you to the project overview for that project.

Checking Project Status

The oc status command provides a high-level overview of the current project, with its components and their relationships. This command takes no argument:

$ oc status

Filtering by Labels

You can filter the contents of a project page in the web console by using the labels of a resource. You can pick from a suggested label name and values, or type in your own. Multiple filters can be added. When multiple filters are applied, resources must match all of the filters to remain visible.

To filter by labels:

  1. Select a label type:

    Web Console Filter Step 1
  2. Select one of the following:

    exists

    Verify that the label name exists, but ignore its value.

    in

    Verify that the label name exists and is equal to one of the selected values.

    not in

    Verify that the label name does not exist, or is not equal to any of the selected values.

    Web Console Filter Step 2
    1. If you selected in or not in, select a set of values then select Filter:

      Web Console Filter Step 3
  3. After adding filters, you can stop filtering by selecting Clear all filters or by clicking individual filters to remove them:

    Web Console Filter Active

Deleting a Project

When you delete a project, the server updates the project status to Terminating from Active. The server then clears all content from a project that is Terminating before finally removing the project. While a project is in Terminating status, a user cannot add new content to the project. Projects can be deleted from the CLI or the web console.

To delete a project using the CLI:

$ oc delete project <project_name>

Project Collaboration in OpenShift Online Pro

Collaboration is not available in OpenShift Online Starter.

Every OpenShift Online Pro account has the ability to add up to 50 collaborator users per subscription. These collaborator users are granted cluster access from OpenShift Online Pro account subscribers so that they can collaborate on projects hosted with OpenShift Online. This allows multiple users to gain access to projects under a single subscription, without having to pay a monthly fee for every account.

Collaboration Restrictions

Collaborators can only access the resources within the projects that they have been granted access. Also, their ability to view, edit, and manage the project resources will depend on the specific role that they have been granted within the project.

Adding Collaborators

OpenShift Online Pro subscribers can add collaborators by following these steps:

  1. Each user you want to add as a collaborator must create a free account at developers.redhat.com. Once your collaborator has confirmed their Red Hat Developers account, you can add them to your subscription.

  2. Each collaborator must sign into developers.redhat.com and click on their name in the upper-right corner to access their account details. Make note of the Red Hat Login ID on this page, as it is the user name you will be required to enter in order to associate the collaborator with your subscription.

  3. Sign in to manage.openshift.com and click on Manage Subscription under the cluster where you want to add the collaborator.

    manage subscriptions collaboration
  4. Once you are in the subscription management console, click the Manage link under the Collaborators heading, which brings you to the Collaboration page.

    manage collaborators
  5. On the Collaboration page, enter the Red Hat Login ID for the user in the user name field and click Add Collaborator.

    You should now see the user listed under your collaborators, the time the user was added, and an option to remove the user from your subscription.

    This does not automatically grant the user any access to your projects. Access must be granted manually by the project owner using oc policy commands or the web console.

Granting Project Access Using the Web Console

After adding the collaborator to your OpenShift Online Pro subscription, you can grant project access to the collaborator using the web console.

  1. From within a project, click Resources, then Membership.

  2. Add roles (for example, view, edit, or admin) to the user you want to grant access.

    See Authorization for more information on access roles.

    Now, when the collaborator user signs in to manage.openshift.com, they will see a card to log in to the web console for the same cluster as your subscription and, if the collaborator was granted access to your projects on the cluster, they will have access just like any other user.

Granting Project Access Using the CLI

After adding the collaborator to your OpenShift Online Pro subscription, you can grant project access to the collaborator using the CLI.

  1. Log in to the cluster through the CLI using your access token.

  2. Grant the user a role using the same user name listed on the Collaboration page using:

    $ oc policy add-role-to-user <role-name> <username>

    For example:

    ~$ oc login https://api.openshift.com --token=<...>
    Logged into "https://api.openshift.com:443" as "exampleuser" using the token provided.
    
    You have one project on this server: "exampleuser-collab"
    
    Using project "exampleuser-collab".
    ~$ oc policy add-role-to-user view collaborator-1234
    role "view" added: "collaborator-1234"

    This example grants view access to the project for user collaborator-1234. See Authorization for more information on access roles.

    Now, when the collaborator user signs in to manage.openshift.com, they will see a card to log in to the web console for the same cluster as your subscription and, if the collaborator was granted access to your projects on the cluster, they will have access just like any other user.

Removing Collaborators

If at any time you wish to remove the user as a collaborator from your subscription, you can do so on the same Collaboration page you used to add them. It is important to note, however, that this will not automatically remove any roles you have assigned the user in your projects. These will need to be manually deleted, or the user may still have access to your projects.

Removing Project Access Using the Web Console

You can remove project access from the collaborator using the web console.

  1. From within a project, click Resources, then Membership.

  2. Remove roles (for example, view, edit, or admin) from the user.

Removing Project Access Using the CLI

You can remove project access from the collaborator using the CLI.

  1. Log in to the cluster through the CLI using your access token.

  2. Remove a role (for example, view, edit, or admin) from a specific collaborator using the same user name listed on the Collaboration page by running:

    $ oc policy remove-role-from-user <role-name> <username>