Team administration
Organizations, teams, roles, quotas, invitations and mail: what cluster admins, owners and team admins do.
People in Harthelm belong to organizations, which hold teams; workspaces, services and domains belong to a
team. Every installation starts with the organization Default and its team Default
(tenancy.defaultOrg, tenancy.defaultTeam).
Roles
| Role | Of | May |
|---|---|---|
| Cluster admin | the installation | everything, on every organization and team, and the platform pages. Members of oidc.adminGroup and the break-glass admin. |
| Owner | an organization | rename it, manage its members, create teams. Owners are admins of every team of the organization. |
| Member | an organization | see it. |
| Admin | a team | rename and delete it, manage its members, domains and registries. |
| Member | a team | see it, create workspaces and managed services. Members are viewers of every workspace of the team. |
| Admin | a workspace | its settings, its members, delete it. Whoever creates a workspace is its admin. |
| Editor | a workspace | the code, the IDE and terminals, Git, the landscape. |
| Viewer | a workspace | look only: overview, logs, read-only files. No IDE, no terminal. |
Roles inherit downwards: an organization owner is admin of its teams, a team admin is admin of its workspaces, a team member is viewer of its workspaces. A workspace role can raise that, never lower it. The console shows inherited roles as such.
Create organizations and teams
- Organizations: only cluster admins create them. In the team switcher click Create organization… and pick the first owner. If you pick someone else, you are not a member of it.
- Teams: owners of an organization (and cluster admins) click Create team… in the team switcher. A creator who is a member of the organization becomes the team's admin.
Every organization keeps at least one owner and every team at least one admin: the last one cannot leave or be demoted.
Invite people
On Members, click Invite people, choose the team or the organization, and either:
- Send an invitation to an email address, with a role. The invited person joins the organization first, then the team. Or:
- Add an existing user: someone who has signed in to Harthelm before, found by their verified email. They get a "you were added" mail.
An invitation is valid for 7 days. With mail on, Harthelm mails the link; without it, the console shows the link once, to copy and pass on. Resend issues a new link with a new expiry (the old link stops working); Revoke withdraws it.
An invitation attaches only to a verified email address that equals the invited one: by the link, from the user's own list of invitations, or automatically at sign-in. If your identity provider does not mark addresses as verified, invitations cannot be accepted; see Sign-in. The invite members guide shows the team admin's side step by step.
Quotas
Each team namespace has a quota for what its workspaces and services may use together: CPU requests, memory requests, memory limits and storage. Creating, syncing or waking anything that does not fit is refused with a message that says how much is missing. A smaller quota never stops what runs.
The default for every team is teams.quota:
teams:
quota: {requestsCpu: "2", requestsMemory: 4Gi, limitsMemory: 8Gi, requestsStorage: 50Gi}
limitRange: {defaultRequestCpu: 100m, defaultRequestMemory: 128Mi, defaultLimitCpu: "", defaultLimitMemory: 512Mi}That fits about five workspaces on the default IDE plan. teams.limitRange sets the defaults for containers that
declare no resources.
A cluster admin can give one team its own quota: on the team's Settings, Quota shows the usage, and
Set own quota (or Change quota) overrides single values; a field left empty uses the installation's
default. Back to default removes the override. The same with the API:
PUT /teams/{team}/quota and
DELETE /teams/{team}/quota (in the REST API reference, tag Teams).
Storage of recently deleted workspaces counts until they are purged; the quota page links to them.
When people leave
Removing someone from a team (or the organization) drops their roles on its workspaces. Workspaces they owned then need a new owner: the git proxy refuses them until an admin offers the ownership to someone and that person accepts. The new owner needs the Editor role and a connection to the workspace's Git provider.
Removing someone from their last organization also deletes their Git connections. Their API keys keep working but reach nothing.
A removal applies at once: the API checks the current roles on every request, and the router closes workspace connections the person opened before.
Delete a team
A team admin deletes a team on its Settings with Delete team…. Harthelm removes its workspaces (and their volumes), managed services, registries, domains and finally its namespace. While it runs the team shows as being deleted; if a step keeps failing the deletion stops with the reason, and deleting again resumes it. Audit rows stay.
Look things up
hart admin users --q example.com
hart admin audit --action team. --since 24hSee hart admin users and hart admin audit.