Organizations

An Organization is an isolated tenant on the controller managed by a partner. An Org typically maps to a customer. After logging into the Operations Console, click on Organizations to view the list of organizations. A partner/provider can manage as many organizations as they require.

Create Org

Sign up for Organization is available in three (3) ways:

1. Using the Swagger based REST APIs

• Login to the console and click API DOCS from the Home page menubar

Platform API screen appears

• Under Organization, use the available REST APIs to signup for new organization(s)

2. Self-service Sign up
A self-service signup page is available for the end users to sign up for a new organization.

• Click SIGN UP and provide the required details
• Click Register

On successful registration, the user will receive a verification email on the given email id. A non-existing user will receive an email with a random password, whereas the existing users will receive a successful org creation email.

These Organizations need to be reviewed and approved by a Partner Admin before they are considered active.

Important
Super Admin can enable or disable the Self Signup option via Ops Console.

3. Register to Add Organization
Add Organization button is available in the Ops Console for Super Admins.

• Login to the Operations Console and click Add Organization
• Provide the required details and click Register

On successful registration, user will receive a verification email.

View Org

Click on Organizations to view the list of Organizations under management by the Partner/Provider.

Search Options

There are multiple search options provided allowing the user to quickly search and list the organizations that match the specified criteria.

• Search by Name: Provide the Organization name to get specific Organization details
• Filter by Status: Select the status, Approved (or) Approval Pending from the drop-down and retrieve the required organization status
• Filter by Partner: Select a partner from the drop-down to view all the organizations available with a specific partner

Update Org

Partner Admins can update an Org using the Operations Console.

• Click on an Org and use the Edit icon to perform any changes in the existing organization. The following changes can be made to an existing Org:

General Settings

• Tier Type: Defines the subscription tier assigned to the organization. Available options:
  • Free: Default tier with limited feature access, primarily for evaluation and small-scale usage.
  • POC (Proof of Concept): Temporary tier for trial and testing purposes with extended capabilities beyond Free, but time-bound.
  • Paid: Full-featured subscription tier with production-grade capabilities, enterprise features, and support enabled.
• Default Currency: Currency used for billing and pricing calculations (e.g., USD, EUR).
• External ID: A unique identifier assigned to this organization, typically used for integrations or external tracking.

Security & Access

• Multi-Factor Authentication (MFA): Require users to provide an additional verification step during login (e.g., OTP, authenticator app) for enhanced security.
• Attribute-Based Access Control (ABAC): Enable fine-grained access control based on user attributes (e.g., department, role, project). Helps enforce security policies dynamically.
• IPv6 Support: Allow IPv6 networking for clusters and services. Useful for modern networking requirements and dual-stack environments.
• IP Whitelist: Restrict access to specific IP addresses or ranges. Only whitelisted IPs can access the organization’s resources.

Registry Configuration

• Registry FQDN: Custom registry Fully Qualified Domain Name (FQDN) used for pulling container images. Example: registry.example.com.

PaaS Settings

The PaaS Settings section allows administrators to manage provisioning control for compute and service instances. When disabled, instance creation is blocked and a custom message is shown to users.

Compute

• Enable or disable compute resources and training capabilities
• Custom Disable Message: Administrators can add an HTML script that is displayed to users when compute provisioning is disabled
• Preview: View how the custom message will appear to users

Service

• Enable or disable service deployment and management features
• Custom Disable Message: Administrators can add an HTML script that is displayed to users when service provisioning is disabled
• Preview: View how the custom message will appear to users

Example Custom Disable Message

<html>
  <body>
    <h2>Service Unavailable</h2>
    <p>PaaS Compute provisioning is currently disabled for your organization due to exceeded resource or quota limits.</p>
    <p>Please contact your administrator or support team for more information.</p>
  </body>
</html>

On-Demand Instance Creation

• Enable or disable on-demand compute instance creation for users
• When disabled, users can create only instances that match an active GPU reservation, preventing on-demand GPU usage outside reserved capacity

SKU Creation

• Enable or disable to allow customer organizations to create and manage their own SKUs
• When disabled at the partner level, the organization-level toggle is locked and cannot be enabled
• A notification message is displayed indicating that SKU Creation must be re-enabled at the partner level before it can be overridden for the organization

Restrict SKU Sharing

• Controls how SKUs (resource bundles or packages) are shared across projects within an organization
• The toggle is off by default, meaning SKU sharing is enabled and shared SKUs are automatically available to all projects
• When enabled, automatic sharing is disabled, and Org Admins can manually control project access to specific SKUs

Token Factory Service

• Enable or disable access to GenAI and Token Factory capabilities for users
• When disabled, users cannot access GenAI resources such as model deployments, inference endpoints, and token usage features
  • Inference Rate Limit Tier: This field is displayed only when the Token Factory Service toggle is enabled. Defines the inference rate limiting tier for the organization. Example: basic, standard

Plugin Settings

• LLM Guardrails: Enable or disable guardrails for LLM interactions and responses

Click Save Changes

Users can verify the custom registry configuration and workload images, as demonstrated in the examples below.

Verify Custom Registry Configuration
Below is an example where Custom Org is configured to use the custom registry FQDN demouser1.registry.net. This will check the bootstrap YAML file to ensure that all specified Rafay service images are correctly listed and sourced from the appropriate user registry, verifying that the deployment configuration is accurate and ready for execution.

cat ~/Downloads/customorg-cluster-1-bootstrap.yaml | grep 'image:'
image: demouser1.registry.net/rafay/rafay-relay-agent-redhat:master-84
image: demouser1.registry.net/rafay/busybox:1.33
image: demouser1.registry.net/rafay/cluster-controller:master-32
image: demouser1.registry.net/rafay/rafay-connector:master-89

Verify Rafay Workloads from Custom Registry
For example, as part of the initial cluster provisioning with a minimal blueprint, the provisioning and blueprint synchronization are successful.

In this example, the organization has a custom registry configured as demouser1.registry.net. All Rafay addons are pulled from this configured custom registry.

To verify the images, run the following command:

kubectl get pods -n rafay-system -o jsonpath="{..image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c
demouser1.registry.net/rafay/busybox:1.33
demouser1.registry.net/rafay/cluster-controller:master-32
demouser1.registry.net/rafay/edge-client:main-34
demouser1.registry.net/rafay/rafay-connector:master-89
demouser1.registry.net/rafay/rafay-relay-agent:master-83

Users

Add Users to an organization or view the existing user details of a specific organization

Feature Capabilities

At the org level, default capability options (enable/disable) can be set. Enable/disable Overrides are available and these override the default capability option

Deactivate Org

Click Deactivate button to deactivate the organization. This blocks all the users within this organization from accessing it. A good example for this action is when an end customer is delinquent on their payments.

Note: Only the Approved organization can be deactivated

Delete Org

Existing Organizations can be deleted permanently if required. Note that this is a destructive, non-reversible action.

Users

As a best practice, we recommend that partners and providers have at least two "partner admins" configured for their Ops Console. This will ensure that they minimize the chance of getting locked out of their console in situations where one of the partners is no longer available or has misplaced their credentials.

Add User

An existing partner admin can add/invite another user as a partner admin.

• Click on Users
• Click on New User
• Enter the email address, first and last name, select partner admin from the dropdown.

The new user will receive an activation email. Once they verify their email address, they will be asked to set a password and will have access to the Operations Console.

View User

To view all users configured to access the Operations Console, click on "Users". This will present you with list of users, their status etc.

Deactivate User

User access to the Operations Console can be temporarily suspended by deactivating the user.

• Click on Actions for the specific user
• Select "Deactivate" from the action dropdown

Follow the same steps to reactivate the deactivated user.

Delete User

Users can be permanently deleted from the Operations Console. Once performed, they will no longer be able to access the console.

• Click on Actions for the specific user
• Select "Delete" from the dropdown actions

Audit Logs

An audit trail is available for activity performed by users on the Operations Console. Click on Audit Logs to view the logs in a reverse chronological format.