Skip to content

Sharing Resources

Every resource belongs to exactly one project. Sharing lets the project that owns a network, firewall or SSH key offer it to other projects of the same organization, so they can build on it instead of making their own copy. For example, a platform project can own a network that VMs from a web project attach to.

Sharing gives use, not control. The owner project keeps full control of the resource. A consuming project can see it and use it from its own resources, but can't change, delete or reshare it.

What you can share

Resource What a consuming project can do with it
Network Attach its own virtual machines and routers to it, and, if it is an external network, use it as a router's external gateway.
Firewall Apply it to its own virtual machines' network interfaces.
SSH key Pick it when creating its own virtual machines.

Other resource types can't be shared.

  • Same organization only, and you name each consuming project (up to 100). There is no "whole organization" option, so a project created later gets nothing until you add it.
  • Same infrastructure. A consuming project can use the resource only from VMs and routers on the resource's infrastructure.
  • Platform only. Sharing changes nothing in your cloud.

Share a resource

From the owner project:

  1. Open the resource from the My networks, My firewalls or My SSH keys tab.
  2. In its Sharing section, click Manage Sharing.
  3. Choose Shared with specific projects and select the Consuming projects. The list offers every project of the organization that you can see.
  4. Click Save sharing.

The resource then shows a Shared badge, and its Sharing section lists the consuming projects. The change is recorded in its Action History. You can change sharing while the resource is Active or Degraded (see Resource statuses).

Stop sharing

Open Manage Sharing, clear the projects you want to remove and click Save sharing. To stop sharing completely, choose Not shared.

Adding projects is always possible. Removing one is not, while it still uses the resource:

  • one of its VMs or routers is attached to the shared network, or one of its routers uses it as its external gateway;
  • one of its VMs has the shared firewall on a network interface;
  • one of its VMs was created with the shared SSH key.

The save is then refused. Use View dependencies to see what uses it.

Ask the consuming project to remove what uses the resource, then try again. A VM can be taken off a network or firewall from its Network Attachments tab. A VM's SSH key can't be changed, so VMs created with a shared key must be deleted.

Once a project is removed, the resource disappears from its Shared with me tab and pickers.

A consuming project can hold up the owner

While a consuming project uses your resource, you can neither remove it from the share nor delete or detach the resource: deletion counts users in every project, and no one can override it. Before you share, agree with the consuming project how and when it will release the resource.

Use a resource shared with your project

Find it

The Networks, Firewalls and SSH Keys pages each have a Shared with me tab next to My …. It lists what other projects have shared with yours, with each resource's Owner project. With a project selected in the header, it shows what is shared with that project.

Resources of projects you can also see

Shared with me lists only resources owned by projects you can't see. A shared resource owned by a project you also have access to is listed under My …, with its owner project. Either way, it is offered in the consuming project's pickers.

Use it

Shared resources appear in the same pickers as your own, marked Shared: the virtual machine wizard (networks, firewalls, SSH keys), a VM's Network Attachments tab, a router's Attach Network, and External network when you create a router. They are offered only on the resource's infrastructure, and only while it is Active or Degraded.

What you create stays yours: the VM or router belongs to your project. Only the shared resource it uses belongs to the other project.

What a consuming project sees

You can open a shared resource and see its details, who it is shared with, and what uses it. Edit, sync, delete, detach and sharing controls aren't offered, and its Action History stays with the owner. If you no longer need a shared resource, remove it from your VMs and routers and tell the owner, so they can stop sharing it.

What sharing reveals

Anyone who can read a shared resource, owner or consumer, can see:

  • its owner project and all its details;
  • every project it is shared with;
  • for a firewall or SSH key, every VM that uses it, in any project, with its name, status and project;
  • for a network, each address in use and what holds it.

So the owner sees what each consumer has built on the resource, and consumers see each other. Share deliberately.

Example: a VM on another project's network

The platform project owns the network core-net on the infrastructure edge-1. The web project needs a VM on it.

In platform (owner): open core-net, click Manage Sharing, choose Shared with specific projects, select web and click Save sharing.

In web (consumer):

  1. Select web in the header. core-net appears under COMPUTE & NETWORK > Networks, on the Shared with me tab, with platform as owner.
  2. Create a virtual machine in web on edge-1, the same infrastructure as core-net.
  3. On the network step, pick core-net (marked Shared). Optionally add firewalls, your own or shared ones.

The VM belongs to web. While it is attached, platform can't remove web from the share or delete core-net. Once web takes the VM off core-net or deletes it, platform can do both.

Permissions

Sharing never grants permissions. Each side needs its usual permissions in its own project:

Task Permission Project
Change who a resource is shared with network_share, firewall_share or sshkey_share The owner project
See shared resources in Shared with me and in pickers network_list, firewall_list or sshkey_list The consuming project
Open a shared resource network_get, firewall_get or sshkey_get (or the matching …_metadata_get) The consuming project
Use a shared resource The usual permissions to create or change the VM or router, plus sshkey_attach to create a VM with an SSH key The consuming project

The share permissions are separate from the update permissions, so you can let someone manage who uses a resource without letting them change it, or the other way round. The OrganizationAdmin role includes them; a custom role needs them added. See the Permissions Reference and Users, Groups and Permissions.