Projects and Quotas
A project tag records which body of regulated work a virtual machine and its drives belong to. A quota is the share of CPU, memory, and storage your team has been allocated, which every running machine draws against. The tag is about classification; the quota is about capacity.
Why a project tag is a classification, not a label
The tag is applied when drives are mounted at boot. That is why changing the project of a running VM has no effect until the machine is restarted, even though the configuration shows the new tag immediately. tiCrypt is enforcing that a machine's regulatory classification is fixed for the life of a session, so a live machine cannot be reclassified out from under the data already open on it.
Classification is what makes the audit trail meaningful. An access record is only useful if it says what kind of data was accessed. Tagging machines and drives with projects is what lets an auditor answer "who touched material under this contract" rather than merely "who started a VM".
Forcing or removing a tag is a declassification action. Removing a tag requires permission to declassify resources in projects you manage, and forcing a tag requires the Arbitrarily tag resources with any project permission. Both are recorded, because they change the compliance status of everything on the machine.
Quota is charged for running instances only. A stopped configuration consumes no CPU or memory, only the storage of its drives. Keeping several configurations for different purposes is free; running them all at once is not.
Before you begin
- You are a member of the project you intend to apply, and are active in it.
- Declassifying requires permission to manage the project in question.
- The VM is powered off if you need the change to take effect immediately.
Set a Project in a Virtual Machine
- Go to the Virtual Machines icon in the top left taskbar.
- Click the VMs section on the top left panel.
- In the left panel, click the menu next to the stopped virtual machine to set a project for.
- Select Change Project.
- In the pop-up, select a project to tag the virtual machine.
- Click Classify.
Change Project appears only for users with the Arbitrarily edit any VM config permission. It also re-tags the drives in the configuration. Other users set the project in the Project (optional) field when they edit the virtual machine.
Forcefully Set a Project in a Virtual Machine
- Go to the Virtual Machines icon in the top left taskbar.
- Click the VMs section on the top left panel.
- In the left panel, click the menu next to the running virtual machine to set a project for.
- Select Set project.
- In the pop-up, select any project to tag the virtual machine.
- Click Force change with admin privilege.
Forcefully tagging a virtual machine with a project is only available to users with the Arbitrarily tag resources with any project permission.
Changing a project tag on a running VM does not take effect until the VM is restarted, even if the VM configuration reflects the updated project tag.
Manage Projects from a Virtual Machine
- Go to the Virtual Machines icon in the top left taskbar.
- Click the VMs section on the top left panel.
- In the left panel, click the project tag on the virtual machine to manage.
- In the new window, click Open overlay in the top right corner.
- In the pop-up, manage the Members, Member Certifications, Subprojects and Security Requirements of the project in the virtual machine.
Remove a Project from a Virtual Machine
- Go to the Virtual Machines icon in the top left taskbar.
- Click the VMs section on the top left panel.
- In the left panel, click the menu next to the stopped virtual machine to remove a project from.
- Select Change Project.
- In the pop-up, select No project (unlocked) to remove the project tag from the VM.
- Click Declassify.
If you have the Arbitrarily tag resources with any project permission and do not belong to the project, tick Use my permission to override rules, re-tag resources with any visible project, regardless of current project relations. in the pop-up, then click Force change with admin privilege to forcibly remove a project tag.
View Live Quota Consumption of a Virtual Machine
- Go to the Virtual Machines icon in the top left taskbar.
- Click the VMs section on the top left panel.
- In the left panel, click the virtual machine to view the live quota consumption.
- Click the VM Settings and Details option in the center right.
- In the new window, view the following in the Overview section.
- CPU : CPU usage of the VM over time, up to its number of cores.
- Memory : Memory used by the VM.
- Network in : Rate of data received by the VM.
- Network out : Rate of data sent by the VM.
- Drives : Used and total space of each attached drive.
- Drive warning : A notice when attached drives are not mounted.
Edit Quota Consumption in a Virtual Machine
VM quotas are determined by the team's allocation. If you need more resources, ask your admin to adjust the team quota.
To edit the drive capacity of a virtual machine, create a new drive or a new virtual machine.
Repair an Unattached Drive in a Virtual Machine
- Go to the Virtual Machines icon in the top left taskbar.
- Click the VMs section on the top left panel.
- In the left panel, click the virtual machine with the drive to repair.
- Click the VM Settings and Details option in the bottom center.
- In the new window, in the Overview section, click the Repair button in the notice that reports unmounted drives.
If a drive is not working properly, consult your admin for guidance.