Creating Organizations

Cluster administrators can create an organization with the Fuzzball CLI subcommand organization create. There is no web UI equivalent.

• Cluster administrator permissions
• Fuzzball CLI with a context configured and logged in as a cluster administrator
• An email address for the person who will own the new organization

Pass the organization name followed by the email address of the person who will own it. That person becomes the organization’s root user – the first account in the organization, created with organization owner permissions. The organization ID is generated for you:

$ fuzzball organization create Test-Organization admin@ciq.com
Organization created:
  ID:        c9261ae5-1a31-4e88-bc74-5520ca661ec4
  Name:      Test-Organization
  Root user: admin@ciq.com

⚠️  GENERATED PASSWORD for admin@ciq.com (save this - it won't be shown again):
  Xk4$mQ9tRv2Lp7Nw

The generated password is displayed only once and cannot be retrieved later. Record it before the command output scrolls away.

If the password is lost, it must be reset from inside the new organization: log in to that organization as one of its owners and run fuzzball organization member update <email> --generate-password – see Managing Passwords. A cluster administrator logged in to a different organization cannot reset it by email address.

No password block is printed when there is no new credential to report – for example when the root user already exists in the deployment’s Keycloak realm, or when the deployment supplies a default password of its own. In those cases the user keeps their existing credential.

To require the root user to choose a new password the first time they log in, add --require-update-password:

$ fuzzball organization create Test-Organization admin@ciq.com --require-update-password

To set a specific organization ID instead of letting the server generate one, pass --id with a UUID. Use this when the ID must match a value configured elsewhere, such as an infrastructure-as-code manifest:

$ fuzzball organization create Test-Organization admin@ciq.com --id $(uuidgen)

On deployments where Fuzzball manages Keycloak itself, --id must be an unused UUID. Fuzzball creates a Keycloak realm with that ID and the command fails if a realm already exists under it.

The fuzzball-admin CLI in the fuzzball-admin-0 pod can also create organizations. It bypasses the Fuzzball API and requires kubectl access to the cluster, so prefer fuzzball organization create above. Reach for it only when the Fuzzball API is unreachable – for example while recovering a deployment whose orchestrate service or Keycloak is down.

Unlike the Fuzzball CLI, fuzzball-admin organization create requires the organization UUID as a third argument:

$ kubectl exec -n fuzzball fuzzball-admin-0 -- /app/fuzzball-admin organization create \
    "Test-Organization" \
    admin@ciq.com \
    c9261ae5-1a31-4e88-bc74-5520ca661ec4
{
  "id": "c9261ae5-1a31-4e88-bc74-5520ca661ec4",
  "name": "Test-Organization",
  "create_time": {
    "seconds": 1720561766,
    "nanos": 239478000
  },
  "update_time": {
    "seconds": 1720561766,
    "nanos": 239478000
  }
}

Log in to the new organization by creating a Fuzzball context and authenticating with the Fuzzball CLI. Once you are logged in, you can add more users – see Adding Users.