Projects #

A project is the main isolation boundary inside an organization. It groups environments, container images, monitoring resources and access rights.

A project is a multi-tenancy soft tenant of its organization: it is identified by a short projectId (for example my-project) and is always addressed together with its organizationId.

Projects are managed through the organization controller (under the organization they belong to). Scoped API keys are managed through the org-apikey controller.

Create a project #

Creates a project and starts provisioning its external resources (Harbor project, Kubernetes namespace, ArgoCD project, monitoring).

const project = await kuzzle.query({
  controller: 'organization',
  action: 'createProject',
  organizationId: 'paas-org-my-company',
  name: 'my-project',
  description: 'Customer production project'
});

HTTP route:

POST /organizations/:organizationId/projects?name=my-project

The response contains the created project identifiers and its Harbor credentials.

List projects #

const projects = await kuzzle.query({
  controller: 'organization',
  action: 'listProjects',
  organizationId: 'paas-org-my-company'
});

HTTP route:

GET /organizations/:organizationId/projects

Get a project #

const project = await kuzzle.query({
  controller: 'organization',
  action: 'getProject',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project'
});

HTTP route:

GET /organizations/:organizationId/projects/:projectId

Delete a project #

Deletes the project and tears down its external resources. Requires an owner or admin role.

await kuzzle.query({
  controller: 'organization',
  action: 'deleteProject',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project'
});

HTTP route:

DELETE /organizations/:organizationId/projects/:projectId

Project members #

Project members are organization members who are also attached to the project. A user must already belong to the organization before being attached to one of its projects. Attaching and detaching require an owner or admin role.

List project members #

const members = await kuzzle.query({
  controller: 'organization',
  action: 'listProjectMembers',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project'
});

HTTP route:

GET /organizations/:organizationId/projects/:projectId/members

Attach a member to a project #

await kuzzle.query({
  controller: 'organization',
  action: 'addProjectMember',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project',
  userId: 'kuid-john-doe'
});

HTTP route:

POST /organizations/:organizationId/projects/:projectId/members?userId=kuid-john-doe

Detach a member from a project #

await kuzzle.query({
  controller: 'organization',
  action: 'removeProjectMember',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project',
  userId: 'kuid-john-doe'
});

HTTP route:

DELETE /organizations/:organizationId/projects/:projectId/members/:userId

GitHub connection #

A project can be connected to a GitHub repository, either created from an organization template or attached to an existing repository. Requires an owner or admin role.

Get the GitHub connection status #

const status = await kuzzle.query({
  controller: 'organization',
  action: 'getGithubRepository',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project'
});

HTTP route:

GET /organizations/:organizationId/projects/:projectId/github

Connect a repository #

Create from a template:

await kuzzle.query({
  controller: 'organization',
  action: 'connectGithubRepository',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project',
  templateRepo: 'template-kiotp-project'
});

Or attach an existing repository:

await kuzzle.query({
  controller: 'organization',
  action: 'connectGithubRepository',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project',
  existingRepo: 'true',
  repo: 'my-existing-repo'
});

HTTP route:

POST /organizations/:organizationId/projects/:projectId/github

Scoped API keys #

Scoped API keys authenticate automated access (CI/CD, the private package registry) to a single project. A key is bound to an identity (a user or a machine identity) and to the project.

Controller: org-apikey

Base HTTP route:

/organizations/:organizationId/projects/:projectId/api-keys

Create an API key #

Requires an owner or admin role. The secret token is returned once, in this response.

const apiKey = await kuzzle.query({
  controller: 'org-apikey',
  action: 'create',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project',
  label: 'ci-deployer',
  identityId: 'app-my-company-ci-deployer'
});

HTTP route:

POST /organizations/:organizationId/projects/:projectId/api-keys?label=ci-deployer

identityId is optional and defaults to the caller.

List API keys #

Available to any project member. Never returns secrets.

const apiKeys = await kuzzle.query({
  controller: 'org-apikey',
  action: 'list',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project'
});

HTTP route:

GET /organizations/:organizationId/projects/:projectId/api-keys

Revoke an API key #

Requires an owner or admin role.

await kuzzle.query({
  controller: 'org-apikey',
  action: 'revoke',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project',
  apiKeyId: '<api-key-id>'
});

HTTP route:

DELETE /organizations/:organizationId/projects/:projectId/api-keys/:apiKeyId

List registry access #

Reads the project's registry-access audit trail (who accessed the registry, and when). Available to any project member.

const access = await kuzzle.query({
  controller: 'org-apikey',
  action: 'listAccess',
  organizationId: 'paas-org-my-company',
  projectId: 'my-project'
});

HTTP route:

GET /organizations/:organizationId/projects/:projectId/api-keys/access

Project container images #

Container images are stored per project in the Kuzzle PaaS registry (Harbor). The deployable image versions of an application are listed through the org-application controller — see List deployable versions.