From 02a820ff458a25aa6dba3e8b2017175759989558 Mon Sep 17 00:00:00 2001 From: miacycle <184569369+miacycle@users.noreply.github.com> Date: Mon, 26 Oct 2026 01:48:30 -0500 Subject: [PATCH 1/5] docs(cloud): which organization a new connection joins Every connection Layer5 Cloud registers now belongs to one organization: the session organization, else the user's only organization, else the only one they own; otherwise registration is refused with meshery_cloud-3632. Documents that the organization never moves and how connections created before October 2026 were assigned one. Pairs with layer5io/meshery-cloud#6334. Signed-off-by: miacycle <184569369+miacycle@users.noreply.github.com> --- .../identity-and-security/organizations/_index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/en/cloud/concepts/identity-and-security/organizations/_index.md b/content/en/cloud/concepts/identity-and-security/organizations/_index.md index 30675b92073..0e8efb345a2 100755 --- a/content/en/cloud/concepts/identity-and-security/organizations/_index.md +++ b/content/en/cloud/concepts/identity-and-security/organizations/_index.md @@ -116,6 +116,18 @@ Assigning a new domain to an organization requires a Provider Admin. Organizatio The organization switcher lists only the organizations the user is a member of. Holders of View All Organizations can also select All Organizations. See [Navigating Organizations]({{< ref "cloud/guides/organizations/org-management/navigating-organizations.md" >}}). +### Which organization a new connection joins + +Every connection you register belongs to one organization, which Layer5 Cloud assigns; you never choose it in the request. It is, in order: + +1. The organization selected for the session: the organization picker in the UI, or the `X-Current-Orgid` header a client sends. +2. If none is selected, the only organization you belong to. +3. If you belong to several, the only one of them you own. + +If none of these names exactly one organization, the registration is refused with `meshery_cloud-3632` (_Select an organization before registering a connection_). Select an organization and register again. A Meshery Server registers connections on your behalf without a header, so it uses your selected organization. + +A connection keeps its organization for life: editing or re-registering it never moves it. Connections created before October 2026 were assigned the organization of their environment, or their owner's only organization. Those whose owner belongs to several organizations have none and remain scoped to their owner. + ## Lifecycle [Organization Management]({{< ref "cloud/guides/organizations/org-management/_index.md" >}}) covers the procedures. From e194b6aa9b381c9c684178d64a88dd5774df7e17 Mon Sep 17 00:00:00 2001 From: miacycle <184569369+miacycle@users.noreply.github.com> Date: Mon, 26 Oct 2026 02:01:07 -0500 Subject: [PATCH 2/5] docs(cloud): re-registration is never refused, and fills a missing organization Signed-off-by: miacycle <184569369+miacycle@users.noreply.github.com> --- .../concepts/identity-and-security/organizations/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/cloud/concepts/identity-and-security/organizations/_index.md b/content/en/cloud/concepts/identity-and-security/organizations/_index.md index 0e8efb345a2..3aa64b808e3 100755 --- a/content/en/cloud/concepts/identity-and-security/organizations/_index.md +++ b/content/en/cloud/concepts/identity-and-security/organizations/_index.md @@ -124,9 +124,9 @@ Every connection you register belongs to one organization, which Layer5 Cloud as 2. If none is selected, the only organization you belong to. 3. If you belong to several, the only one of them you own. -If none of these names exactly one organization, the registration is refused with `meshery_cloud-3632` (_Select an organization before registering a connection_). Select an organization and register again. A Meshery Server registers connections on your behalf without a header, so it uses your selected organization. +If none of these names exactly one organization, creating the connection is refused with `meshery_cloud-3632` (_Select an organization before registering a connection_). Select an organization and register again. Re-registering a connection that already exists is never refused for this reason. A Meshery Server registers connections on your behalf without a header, so it uses your selected organization. -A connection keeps its organization for life: editing or re-registering it never moves it. Connections created before October 2026 were assigned the organization of their environment, or their owner's only organization. Those whose owner belongs to several organizations have none and remain scoped to their owner. +A connection keeps its organization for life: editing or re-registering it never moves it. Connections created before October 2026 were assigned the organization of their environment, or their owner's only organization. A connection whose owner belongs to several organizations got none, and stays scoped to its owner until the owner re-registers it, when it takes the organization it is registered in. ## Lifecycle From e9d77d6e721637cacb62743496253b7f9baf5882 Mon Sep 17 00:00:00 2001 From: miacycle <184569369+miacycle@users.noreply.github.com> Date: Mon, 26 Oct 2026 14:56:01 -0500 Subject: [PATCH 3/5] docs(cloud): reviving a deleted connection, the 409, and legacy connection cleanup Signed-off-by: miacycle <184569369+miacycle@users.noreply.github.com> --- .../identity-and-security/organizations/_index.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/en/cloud/concepts/identity-and-security/organizations/_index.md b/content/en/cloud/concepts/identity-and-security/organizations/_index.md index 3aa64b808e3..47821e8ea63 100755 --- a/content/en/cloud/concepts/identity-and-security/organizations/_index.md +++ b/content/en/cloud/concepts/identity-and-security/organizations/_index.md @@ -124,9 +124,13 @@ Every connection you register belongs to one organization, which Layer5 Cloud as 2. If none is selected, the only organization you belong to. 3. If you belong to several, the only one of them you own. -If none of these names exactly one organization, creating the connection is refused with `meshery_cloud-3632` (_Select an organization before registering a connection_). Select an organization and register again. Re-registering a connection that already exists is never refused for this reason. A Meshery Server registers connections on your behalf without a header, so it uses your selected organization. +If none of these names exactly one organization, creating the connection is refused with `meshery_cloud-3632` (_Select an organization before registering a connection_). Select an organization and register again. Re-registering a connection you already have is never refused for this reason. A Meshery Server registers connections on your behalf without a header, so it uses your selected organization. -A connection keeps its organization for life: editing or re-registering it never moves it. Connections created before October 2026 were assigned the organization of their environment, or their owner's only organization. A connection whose owner belongs to several organizations got none, and stays scoped to its owner until the owner re-registers it, when it takes the organization it is registered in. +Editing or re-registering a connection never moves it to another organization. + +Registering a connection you deleted brings it back, and it joins the organization it is registered in now, not the one it had before. Registering a connection ID that belongs to someone else, or to a connection of a different kind, is refused with `meshery_cloud-3633` (_The connection id is already in use_). The answer is the same whether or not that connection exists. Register without an ID, or with the ID of a connection you own. + +Connections created before October 2026 had no organization. Each was assigned the organization it could be traced to: the organization of its environments, else its owner's only organization, else the only one of its owner's organizations the owner owns. Connections that could not be traced to exactly one organization were deleted, along with any credential no other connection used. Register them again to recreate them. ## Lifecycle From 8e29d5aeb21926425af0cb63bc1d3f7a8ec3900a Mon Sep 17 00:00:00 2001 From: Marcus <158522975+marblom007@users.noreply.github.com> Date: Mon, 26 Oct 2026 15:25:08 -0500 Subject: [PATCH 4/5] Sync registerConnection OpenAPI description with connection organization rules data/openapi.yml documented only assignment from X-Current-Orgid or the caller's selected organization. It now documents the full rule from layer5io/meshery-cloud#6334 (server/handlers/connection_organization.go): - the single-organization and sole-owner fallbacks, in order; - refusal with 400 / meshery_cloud-3632 when none names exactly one organization, and that re-registering a live connection is never refused for this reason and keeps its organization; - the legacy exception: connections predating the v1beta3 contract (October 2026) may carry no organization. Addresses CodeRabbit's OpenAPI-sync minor on this PR. The Cloud side does not carry this text in its own spec files in #6334, so the docs copy is updated here. Signed-off-by: Marcus <158522975+marblom007@users.noreply.github.com> --- data/openapi.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/data/openapi.yml b/data/openapi.yml index b184771c488..0553e426ce3 100644 --- a/data/openapi.yml +++ b/data/openapi.yml @@ -31992,8 +31992,15 @@ paths: it is refused with a `409` MeshKit error that names the reserved GitHub App connection identity. - Every connection belongs to exactly one organization. The server assigns `organizationId` from the session - (`X-Current-Orgid`, then the caller's selected organization) and does not accept it in the body. + Every connection created under this contract belongs to exactly one organization. The server assigns + `organizationId` and does not accept it in the body. In order, it uses the session organization + (`X-Current-Orgid`, then the caller's selected organization), then the only organization the caller belongs + to, then the only one of those the caller owns. If none of these names exactly one organization, registration + is refused with `400` and error `meshery_cloud-3632` (_Select an organization before registering a + connection_); select an organization and register again. Re-registering a connection that is still live is + never refused for this reason, and it keeps the organization it already has. Connections created before the + v1beta3 contract (October 2026) may carry no organization; they are the only exception to the one-organization + rule. Desktop registration uses this shared operation, but kind `desktop` is implemented by Cloud: a server that does @@ -32022,8 +32029,10 @@ paths: required: false description: > Session organization. The server assigns `Connection.organizationId` from this header when it is present, - and from the caller's selected organization when it is absent. Kind `desktop` requires the header: a desktop - registration without it is refused with 400. + and from the caller's selected organization when it is absent. If neither names an organization, it falls + back to the caller's only organization, then to the only one of those the caller owns, and refuses with + `400` (`meshery_cloud-3632`) when none of these names exactly one. Kind `desktop` requires the header: a + desktop registration without it is refused with 400. schema: type: string format: uuid From 9a8e8c3bf51d4ed2068f75b8c45715f341b9e284 Mon Sep 17 00:00:00 2001 From: Lee Calcote Date: Mon, 26 Oct 2026 16:31:18 -0500 Subject: [PATCH 5/5] docs(cloud): connections linked to a profile take the profile's organization Signed-off-by: Lee Calcote --- .../concepts/identity-and-security/organizations/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud/concepts/identity-and-security/organizations/_index.md b/content/en/cloud/concepts/identity-and-security/organizations/_index.md index 47821e8ea63..e894ecaa44b 100755 --- a/content/en/cloud/concepts/identity-and-security/organizations/_index.md +++ b/content/en/cloud/concepts/identity-and-security/organizations/_index.md @@ -130,7 +130,7 @@ Editing or re-registering a connection never moves it to another organization. Registering a connection you deleted brings it back, and it joins the organization it is registered in now, not the one it had before. Registering a connection ID that belongs to someone else, or to a connection of a different kind, is refused with `meshery_cloud-3633` (_The connection id is already in use_). The answer is the same whether or not that connection exists. Register without an ID, or with the ID of a connection you own. -Connections created before October 2026 had no organization. Each was assigned the organization it could be traced to: the organization of its environments, else its owner's only organization, else the only one of its owner's organizations the owner owns. Connections that could not be traced to exactly one organization were deleted, along with any credential no other connection used. Register them again to recreate them. +Connections created before October 2026 had no organization. Each was assigned the organization it could be traced to: the organization of the profiles it is linked to, else the organization of its environments, else its owner's only organization, else the only one of its owner's organizations the owner owns. Connections that could not be traced to exactly one organization were deleted, along with any credential no other connection used. Register them again to recreate them. ## Lifecycle