Applications Systems
VIM and VMAN account limitations
This article provides an overview of VIM and VMAN account limitations.
First published date
Last published date
Overview
Product section
Resolution
About virtualization limitations
You can set virtualization limitations on several entities, including:
- VCenter
- Datacenter
- Cluster
- Host
- Virtual Machine
- Datastore
Virtualization limitations are separate from Orion Node limitations:
-
If you limit an user account to see a VM, the user can only see the VM and no other virtualization entities. The user can also see the Node.
-
If you limit a user account to see a node, the user can only see the node and its child entities. The user cannot see any VMs/hosts/VCenters linked to the node. If the node is a host, the user will see all child VMs.
Because of this behavior, you must configure limitations both on Virtualization entities and Nodes, to correctly define the part of environment the user is allowed to see.
How limitations work
The limitations are applied to the entities in two directions at the same time. These limitations include DOWN and UP.
Down
When the limitation is set to some entity, the user should be able to see all children. For example, the limitation on a single cluster allows the user to see the targeted cluster and its children. This includes hosts and virtual machines.
Up
When limitation is set to some entity, the user should not be able to see the parents of the limited entity. For example, a limitation on a single host will cause that parent cluster, datacenter, and VCenter to be invisible.
Additional considerations
The user with the limitation cannot see anything above the level for which the limitation is set.
When you limit a user account to see an entity, this limitation affects all entities on the same level as the entity.
Example 1: Limitation = C1
For example, placing a limitation on a cluster impacts all hosts with a cluster. The hosts are visible only if their cluster passes the limitation. Stand-alone hosts that are not in a cluster will be visible. If the cluster relation is missing, they cannot be limited.
This behavior allows you to configure special use cases in environments where there are both clustered hosts and non-clustered hosts.
Multiple limitations with the AND operator
You can apply three limitations for the user using the AND operator. If you set multiple user VIM limitations, the user will be able to see only the intersections.
If there are no intersections, no data is available.
Example 2: Limitation = C1 AND H2
Consider Cluster C1 with Host H1 and Cluster C2 with Host H2.
Set a limitation for Cluster C1 AND Host H2.
Result:
The user with this limitation can see C1 because of the cluster's limitation. The cluster is the highest limited entity here, so no intersection is necessary.
H2 is not visible because its cluster C2 is not part of the limitation, and thus no child entities are visible.
Group (container) limitations use the AND operator
When you use Group (Container) limitations, the behavior is the same as for virtualization limitations.
You can combine many different entity types in one group, so you are not limited to use only three different limitations.
Best Practice: Create a group with both Node and Virtualization entities in it. In case of limitation for H1, include the H1 Node (N1) entity and H1 Virtualization Host entity into the group.
Example 3: Limitation = Group (C1 + H2)
Limit the user account to a group that consists of C1 AND H2.
Result:
Only C1 is visible - it's because the Cluster is the highest entity in the limitation and thus there doesn't need to be any intersection for it to be visible for the user.
Example 4: Limitation = Group (C1 + H1 + N1)
Limit the user account to a group that consists of C1 and H1 and N1.
The user can see C1, H1 and its children in the virtual hierarchy, as well as N1.
Datastores
Datastores (which aren't in the picture) are different from the traditional parent child hierarchy. In this configuration, limitation needs to be configured separately. Setting the limitation on a datastore does not affect any other virtualization entity.