This page explains how to get access to the Tucson OpenShift cluster (tuc-ocp). You do not need to know anything about OpenShift administration. You need an IBM w3id account, a Bluegroup, and one ticket.

• You log in with your w3id. There are no separate passwords.
• What you can do is decided by Bluegroup membership. If you are in the right Bluegroup, you get the right access to your project. If you leave the Bluegroup, you lose it.
• Each project (namespace) has up to three Bluegroups: one for each access level.
• Cluster admins do not add people to projects by hand. They only create your login and the project. Group membership then follows your Bluegroup automatically.

So the rule is: Bluegroup first, ticket second.

Choose the lowest level that lets you do your job. If you only deploy and debug, ask for Developer, not Admin.

Cluster-wide admin is not given per project. It is only for the platform team.

Only needed for a new project. For an existing project, use the name that already exists.

Rules for the project name:

• Lowercase letters, digits and - only. No spaces, no capital letters, no underscores.
• Up to 30 characters.
• Must not start or end with -.
• Short and clear: the team or the purpose, for example ceph-test or ceph-qe-ci.
• Reserved, cannot be used: names starting with openshift or kube-, and default and ldap-group-sync.
• The name must not already be in use. Ask in the ticket if you are not sure.

The Bluegroup names are always built from the project name. They must match exactly, or the ticket cannot be processed.

You only need to create the levels that you will use. Unused levels are fine.

1. Open the Bluegroups tool: https://bluepages.ibm.com/tools/groups/protect/groupsgui.wss
2. Create the Bluegroup(s) with the exact names from the table above.
3. Add the people who need access. A Bluegroup with no members is rejected, so add at least one person (yourself is fine).
4. Use only these characters in the name: A-Z a-z 0-9 . _ -
5. Then go to Step 4 and submit the ticket.

1. Do not submit a ticket yet.
2. Ask the Bluegroup owner to add you as a member. Or add yourself if you are an owner.
3. Check that you are really in the group (see https://bluepages.ibm.com/tools/groups/protect/groupsgui.wss).
4. Only after you are a member, submit the ticket in Step 4.

A ticket sent before you are a member will be sent back and will only delay you.

1. Open https://tracker.ceph.com/projects/internal_lab/issues/new
2. Subject: Tucson OpenShift access: <project name> (new / existing), for example Tucson OpenShift access: ceph-test (new)
3. Copy the template below into the description and fill in every line.
4. Create one ticket per project. If several people from the same project need access, list all of them in one ticket.

Cluster:            tuc-ocp (Tucson OpenShift)
Project name:       <project, lowercase, e.g. ceph-test>
Project type:       New | Existing
Purpose:            <one line: what the project is for>

Bluegroups (must already exist, and you must be a member):
  Admins:           <project>-admins        (or "not needed")
  Developers:       <project>-developers    (or "not needed")
  Viewers:          <project>-viewers       (or "not needed")
Bluegroups created / confirmed:  Yes

Users who need to log in (IBM e-mail, as shown in w3id / Bluepages):
  1. first.last@ibm.com   - Bluegroup: <project>-developers
  2. first.last@ibm.com   - Bluegroup: <project>-viewers

Project owner / approver:  <name and IBM e-mail>
Needed until:              <date, or "permanent">

You do not need to do anything here. This is only so you know what is happening:

1. They check the ticket: the Bluegroups exist and the approver is correct.
2. For a new project, they create the project and its access rules on the cluster.
3. They create your login on the cluster (your w3id e-mail).
4. They load the Bluegroup members into the cluster. After this, your Bluegroup gives you your access level.
5. They update the ticket when it is done.

After the ticket says access is ready:

Web console

1. Open https://console-openshift-console.apps.tuc-ocp.os.ceph.tuc.ibm.com
2. Choose w3id and sign in with your IBM account.
3. You will see only your own project(s).

Command line (oc)

oc login --web --server=https://api.tuc-ocp.os.ceph.tuc.ibm.com:6443
oc get projects
oc get pods -n <project>

You do not need a ticket for these. Only change the Bluegroup:

You do need a ticket when:

• Someone logs in to the cluster for the first time (they need a login created).
• You want a new project.
• You want a new access level (a new Bluegroup) for an existing project.
• A person has left IBM or the team permanently and their login should be removed.

Group changes can take some time to appear (up to about 30 minutes, once automatic sync is active). If you still have no access after that, check the troubleshooting section below.

• This is a lab cluster. Do not store production or customer data.
• Do not share your login or tokens. Access is personal.
• You can only use your own project(s). Other projects and cluster settings are not visible to you.
• Access is reviewed. Remove people from the Bluegroup when they no longer need it.

1. I know my project name (lowercase, up to 30 characters).
2. The Bluegroup(s) exist and have the exact names.
3. I am a member of the Bluegroup (for an existing project).
4. I used my IBM e-mail.
5. I submitted one ticket at https://tracker.ceph.com/projects/internal_lab/issues/new with the template filled in.