vSphere Permission Requirements for CAPV
The vSphere user account leveraged for CAPV must have approprate vSphere permissions. vCenter's Administrator role provides super-user access to all vSphere objects, however use of this role may be discouraged in your environment.
We'll work over providing a base set of permissions and then removing what's neeeded in the two specific vSphere based roles:
- Template management role
- "Service Account" type role for CAPV
- "Addon based" role for components enabled by CAPV
Alternatively, you can choose to create a custom role with the minimum set of privileges to allow use of CAPV as detailed below:
User requirements to allow upload of OVA/OVF (TODO: VERIFY THIS SECTION)
https://kb.vmware.com/s/article/2105932
Initially we'll create an administrator account and then test with the following permission set:
- Datastore > Allocate space
- Network > Assign network
- Virtual machine > Configuration > Add new disk
- Virtual machine > Configuration > Advanced
- vApp > Import
User requirements to allow for CAPV Controllers to work in a vSphere environment:
Add the VMware CSI Cloud Native Storage Capabilities Perms (we install this)
Create Virtual Machine Permissions
Destination folder or Datacenter:
- Virtual machine.Configuration.Add new disk (if creating a new virtual disk)
- Virtual machine.Configuration.Add existing disk (if using an existing virtual disk)
- Virtual machine.Configuration.Configure Raw device (if using an RDM or SCSI pass-through device)
On the destination host, cluster, or resource pool:
- Resource.Assign virtual machine to resource pool
On the destination datastore or the folder that contains the datastore:
On the network that the virtual machine will be assigned to:
Power Management on virtual machines
On the data center in which the virtual machine is deployed:
- Virtual machine .Interaction .Power On
On the virtual machine or folder of virtual machines:
- Virtual machine .Interaction .Power On
Deploy a virtual machine from template
On the destination folder or data center:
- Virtual machine .Inventory.Create from existing
- Virtual machine.Configuration.Add new disk
On a template or folder of templates:
- Virtual machine .Provisioning.Deploy template
On the destination host, cluster or resource pool:
- Resource.Assign virtual machine to resource pool
On the destination datastore or folder of datastores:
On the network that the virtual machine will be assigned to:
Google GKE Recommendations (TODO: COMB THROUGH THESE)
Resource:
- Assign (required to move )
Datastore:
- Allocate space
- Browse datastore
- Low level file operations
- Remove file
- Update virtual machine files
- Update virtual machine metadata
Datastore
- Allocate space
- Browse datastore
- Low level file operations
- Remove file
- Update virtual machine files
- Update virtual machine metadata
Folder
- Create folder
- Delete folder
- Move folder
- Rename folder
vSphere Tagging
Root vCenter Server
Network
Resource
- Apply recommendation
- Assign virtual machine to resource pool
Storage views
Tasks
vApp
- Import
- vApp application configuration
- vApp instance configuration
Virtual machines
- Configuration
- Add existing disk
- Add new disk
- Add or remove device
- Advanced
- Change CPU count
- Change resource
- Configure managedBy
- Disk change tracking
- Disk lease
- Display connection settings
- Extend virtual disk
- Host USB device
- Memory
- Modify device settings
- Query Fault Tolerance compatibility
- Query unowned files
- Raw device
- Reload from path
- Remove disk
- Rename
- Reset guest information
- Set annotation
- Settings
- Swapfile placement
- Toggle fork parent
- Unlock virtual machine
- Upgrade virtual machine compatibility
Guest operations
- Guest operation alias modification
- Guest operation alias query
- Guest operation modifications
- Guest operation program execution
- Guest operation queries
(RATIONALIZE WITH cloud-init + colone)Interaction
- Answer question
- Backup operation on virtual machine
- Configure CD media
- Configure floppy media
- Console interaction
- Create screenshot
- Defragment all disks
- Device connection
- Drag and drop
- Guest operating system management by VIX API
- Inject USB HID scan codes
- Pause or Unpause
- Perform wipe or shrink operations
- Power off
- Power on
- Record session on virtual machine
- Replay session on virtual machine
- Reset
- Resume Fault Tolerance
- Suspend
- Suspend Fault Tolerance
- Test failover
- Test restart Secondary VM
- Turn off Fault Tolerance
- Turn on Fault Tolerance
- VMware Tools install
Inventory
- Create from existing
- Create new
- Move
- Register
- Remove
- Unregister
Provisioning
- Allow disk access
- Allow file access
- Allow read-only disk access
- Allow virtual machine download
- Allow virtual machine files upload
- Clone template
- Clone virtual machine
- Create template from virtual machine
- Customize
- Deploy template
- Mark as template
- Mark as virtual machine
- Modify customization specification
- Promote disks
- Read customization specifications
Service configuration
- Allow notifications
- Allow polling of global event notifications
- Manage service configurations
- Modify service configuration
- Query service configurations
- Read service configuration
(LIKELY NOT NEEDED)Snapshot management
- Create snapshot
- Remove snapshot
- Rename snapshot
- Revert to snapshot
(NOT NEEDED) vSphere Replication
- Configure replication
- Manage replication
- Monitor replication
Creating the CAPV Role in vCenter
A role can be created in your vCenter by using the govc utility:
Google Drive
Gist
Clipboard
-
Any changes
Be notified of any changes
-
Mention me
Be notified of mention me
-
Unsubscribe
Subscribe