Chapter 2. Projects

Procedure

1. To view a list of projects, enter the following command:

   $ oc get projects

2. To change from the current project to a different project for CLI operations, enter the following command. The specified project is then used in all subsequent operations that manipulate project-scoped content.

   $ oc project <project_name>

Procedure

1. In the Developer perspective, navigate to the Project page.
2. Select your project from the Project menu.
3. Select the Project Access tab.

4. Click Add access to add a new row of permissions to the default ones.

   Figure 2.2. Project permissions

   
5. Enter the user name, click the Select a role drop-down list, and select an appropriate role.
6. Click Save to add the new permissions.

7. Optional: You can complete any of the following additional tasks:

   • The Select a role drop-down list, to modify the access permissions of an existing user.

   • The Remove Access icon, to completely remove the access permissions of an existing user to the project.

     Note

     Advanced role-based access control is managed in the Roles and Roles Binding views in the Administrator perspective.

Procedure

1. In the Administrator perspective, navigate to Administration Cluster settings.
2. Click the Configuration tab.
3. From the Configuration resource list, select Console operator.openshift.io.
4. Navigate to the YAML tab to view and edit the YAML code.

5. In the YAML code under spec, customize the list of available cluster roles for project access. The following example specifies the default admin, edit, and view roles:

   apiVersion: operator.openshift.io/v1
   kind: Console
   metadata:
     name: cluster
   # ...
   spec:
     customization:
       projectAccess:
         availableClusterRoles:
         - admin
         - edit
         - view

6. Click Save to save the changes to the Console configuration resource.

Verification

1. In the Developer perspective, navigate to the Project page.
2. Select a project from the Project menu.
3. Select the Project access tab.
4. Click the menu in the Role column and verify that the available roles match the configuration that you applied to the Console resource configuration.

Procedure

1. Navigate to the +Add page.
2. Select your project from the Project menu.

3. Click an item on the +Add page and then follow the workflow.

   Note

   You can also use the search feature in the +Add page to find additional items to add to your project. Click + under Add at the top of the page and type the name of a component in the search field.

Procedure

1. Navigate to Home Projects.
2. Select a project from the list.
3. Review the project status in the Overview page.

Procedure

1. Switch to your project:

   $ oc project <project_name>

   • Replace <project_name> with the name of your project.

2. Obtain a high-level overview of the project:

   $ oc status

Procedure

1. Log in as a user with cluster-admin privileges.

2. Generate the default project template:

   $ oc adm create-bootstrap-project-template -o yaml > template.yaml

3. Use a text editor to modify the generated template.yaml file by adding objects or modifying existing objects.

4. The project template must be created in the openshift-config namespace. Load your modified template:

   $ oc create -f template.yaml -n openshift-config

5. Edit the project configuration resource using the web console or CLI.

   • Using the web console, complete the following tasks:

     1. Navigate to the Administration Cluster Settings page.
     2. Click Configuration to view all configuration resources.
     3. Find the entry for Project and click Edit YAML.

   • Using the CLI, complete the following tasks:

     1. Edit the project.config.openshift.io/cluster resource:

        $ oc edit project.config.openshift.io/cluster

6. Update the spec section to include the projectRequestTemplate and name parameters. Ensure you set the name of your uploaded project template. The default name is project-request.

   Project configuration resource with custom project template

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
   # ...
   spec:
     projectRequestTemplate:
       name: <template_name>
   # ...

7. After you save your changes, create a new project to verify that your changes were successfully applied.

Procedure

1. Log in as a user with cluster-admin privileges.

2. View the self-provisioners cluster role binding usage by running the following command:

   $ oc describe clusterrolebinding.rbac self-provisioners

   Example output

   Name:		self-provisioners
   Labels:		<none>
   Annotations:	rbac.authorization.kubernetes.io/autoupdate=true
   Role:
     Kind:	ClusterRole
     Name:	self-provisioner
   Subjects:
     Kind	Name				Namespace
     ----	----				---------
     Group	system:authenticated:oauth

   Review the subjects in the self-provisioners section.

3. Remove the self-provisioner cluster role from the group system:authenticated:oauth.

   • If the self-provisioners cluster role binding binds only the self-provisioner role to the system:authenticated:oauth group, run the following command:

     $ oc patch clusterrolebinding.rbac self-provisioners -p '{"subjects": null}'

   • If the self-provisioners cluster role binding binds the self-provisioner role to more users, groups, or service accounts than the system:authenticated:oauth group, run the following command:

     $ oc adm policy \
         remove-cluster-role-from-group self-provisioner \
         system:authenticated:oauth

4. Edit the self-provisioners cluster role binding to prevent automatic updates to the role. Automatic updates reset the cluster roles to the default state.

   • To update the role binding by using the CLI, complete the following steps:

     1. To edit the self-provisioners cluster role binding, enter the following command:

        $ oc edit clusterrolebinding.rbac self-provisioners

     2. In the displayed role binding, set the rbac.authorization.kubernetes.io/autoupdate parameter value to false, as shown in the following example:

        apiVersion: authorization.openshift.io/v1
        kind: ClusterRoleBinding
        metadata:
          annotations:
            rbac.authorization.kubernetes.io/autoupdate: "false"
        # ...

   • To update the role binding, run the following single command:

     $ oc patch clusterrolebinding.rbac self-provisioners -p '{ "metadata": { "annotations": { "rbac.authorization.kubernetes.io/autoupdate": "false" } } }'

5. Log in as an authenticated user and verify that the user can no longer self-provision a project:

   $ oc new-project test

   Example output

   Error from server (Forbidden): You may not request a new project via this API.

   Consider customizing this project request message to provide more helpful instructions specific to your organization.

Procedure

1. Edit the project configuration resource using the web console or CLI.

   • By using the web console, complete the following steps:

     1. Navigate to the Administration Cluster Settings page.
     2. Click Configuration to view all configuration resources.
     3. Find the entry for Project and click Edit YAML.

   • By using the CLI, complete the following steps:

     1. Log in as a user with cluster-admin privileges.

     2. Edit the project.config.openshift.io/cluster resource:

        $ oc edit project.config.openshift.io/cluster

2. Update the spec section to include the projectRequestMessage parameter and set the value to your custom message:

   Project configuration resource with custom project request message

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
   # ...
   spec:
     projectRequestMessage: <message_string>
   # ...

   The following example uses actual values:

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
   # ...
   spec:
     projectRequestMessage: To request a project, contact your system administrator at projectname@example.com.
   # ...

3. After saving your changes, attempt to create a new project by using a developer or service account that cannot self-provision projects. By doing this task, you can verify that your changes were successfully applied.