En
Es
The Projects module allows grouping services ordered by a client into separate spaces within a single account. Using the module allows:
- the client:
- logically group services. For example, by departments or business directions;
- restrict access to services for different employees;
- control the budget for each direction separately;
- the provider:
- configure service isolation in a separate tenant of the external virtualization platform;
- group tariffs of different product types into convenient sections. For example, group virtual servers together with networks, and domains together with SSL certificates.
Working principle
A project is used only to group client services. The account and client area remain unified for all of the client's projects.
Service grouping
A service can belong to no more than one project. Adding a service to a project is done manually or automatically at the time of order. Deleting a project is impossible until all services are detached from it. Services that do not belong to any project are displayed in the general list without specifying a project.
For information on how to distribute previously created services across projects, see the Migrating services to projects article.
Access restriction
The platform offers the following levels of project management:
- platform administrator — configures the module for providers, manages projects for all clients;
- client administrator — a user with Full access — creates projects, sets cost limits, and assigns members. The role is available only after installing the Project module;
- project user — works only with services from the projects they are added to;
- user with the Accounting role — does not have access to products and services, but can exit the project context (mode Project not selected) and switch between projects to view financial information, manage payments, and handle payers.
A user without Full access sees only services from the projects they are included in. When switching between projects, service lists, widgets, and notifications in the platform interface are filtered. Notifications to client users are also sent based on project access: users do not receive notifications about services they do not have access to.
To simplify permission configuration in the module, a built-in "Project user" role is provided. This role grants access to ordering and consuming services without the ability to work with financial documents and payments. Ordering a service for such a user is simplified: they select a resource and click the activation button, and payment is automatically deducted from the general account.
To automate access management, synchronization of users from a directory (e.g., LDAP or Active Directory) with project binding is supported.
For more information, see the Setting up the "project user" role article.
Module features
The module implements resource management functions and expense control:
- managing the list of projects in the client area and in the platform interface for employees;
- attaching a service to a project when ordering or manually;
- service visibility restriction for project users;
- setting a cost limit by specifying the amount, start date, and alert threshold;
- payment display restriction for projects (when the setting is enabled, payments are displayed separately for each project, by default they are collected together);
- infrastructure isolation of cloud category services in a separate tenant of the external virtualization system.
Cost limits
A cost limit can be set for a project by specifying the amount, start date, and alert threshold. If the limit is exceeded, the platform blocks ordering new services, renewals, and tariff changes with additional payments. Available project funds are calculated as the lesser of two values: the project limit balance and the account balance. This rule applies as long as the client's account is not blocked. For more details, see the Cost limit and expense control article.
Expense accounting
The platform allows:
- separating payments by projects;
- creating a payment for unpaid expenses for a specific project;
- separating completed work acts by project.
For more details, see the Project expense tracking and invoicing article.
Infrastructure isolation
When working with cloud categories, the platform ensures service isolation in a separate tenant of the external virtualization system. For example, in VMmanager 6. A separate cloud, virtual network, and account are created for each project.
When creating a cloud for a project, private networks are created automatically. Virtual machines are isolated within their private network and receive a private IP address. The client does not have direct access to the external virtualization system interface: the click to enter the processing module control panel is hidden, and all resource operations are performed exclusively through the BILLmanager interface.
The project cloud is configured as a service of the billcloud product type. Opening the service creates a tenant in the external system, closing it deletes it. The provider independently chooses the moment to create the cloud: when creating a new project or when ordering a cloud category service for the first time.
For more details on the data synchronization mechanism and resource discovery in the external virtualization system, see the Project cloud synchronization article.
Order of work
Basic setup
To get started with projects:
- Install and configure the Project module. For more information, see the Installation and configuration of the "Projects" module article.
- Enable project functionality for the provider.
- Verify that a project named "New project" has been created for existing clients.
After enabling the module, all previously created services receive the status "Project not selected". To use access restrictions and limits, distribute them across projects. For more information, see the Migrating services to projects article.
Advanced setup
If you plan to provide services with isolation in a separate tenant, after basic setup:
- Configure a separate processing module, which the platform will use to create isolated tenants for projects. For example, see the Processing module. VMmanager 6 article for configuring VMmanager.
- Prepare cloud tariffs. For more information, see the How to create and configure a tariff plan article.
- Create a cloud category. For more information, see the Catalog categories article.
- Add resource tariffs to the category. For more information, see the Catalog categories article.
- Activate the category for ordering. In the cloud categories list, select the required row and click the On button so that clients can see this category when ordering services.