Administering a tenant

Tenant admin

A tenant administrator owns one tenant: its people, its compute, its storage and its money. Signing in as one adds an ADMIN section to the navigation below the ordinary pages.

What you control

Users and groupsAccounts, and the groups that carry every limit and permission your users have.

ProjectsShared token budgets, their members and their storage.

QueuesWhat your users can submit to, and which nodes and storage back it.

StorageStorages, shared storages and the buckets users actually see.

NodesThe machines, and the invitations that let new ones join.

Tenant tokensThe tenant balance, and allocating from it to users and projects.

Tenant settingsRegistration, invitations, LDAP, registries and outgoing mail.

Recurring tasksScheduled token grants.

What you do not control

These belong to a superadmin:

• Creating or disabling tenants, including your own
• Global nodes and queues shared across tenants
• System-wide settings: token pricing, the platform SMTP relay, relay configuration
• Whether open registration is permitted at all

Global resources are read-mostly for you

A global queue or node assigned to your tenant can be enabled or disabled by you, but not edited or removed. The superadmin owns the object; you own whether your tenant uses it.

The order that saves time

Setting up a tenant from scratch, this sequence avoids backtracking:

1. Nodes - issue an invite and let a machine connect. Without a node, nothing else can be tested.
2. Storage - register the storage on that node, then the buckets users will see.
3. Queues - create the queue, link it to the nodes and to the storages. Skipping the storage link is the single most common misconfiguration; it produces a queue on which no user can mount anything.
4. Groups - set limits and permissions, then grant the group its queues and storage.
5. Users - create them and put them in a group.
6. Tokens - give the tenant a balance and allocate from it.

A user with no group has no queues, no storage and no permission to add jobs. That is the default, and it is why a freshly created user cannot do anything until step 4 and 5 are connected.