A key feature of the remote plugin is Role-Based Access Control (RBAC). RBAC for the Everpure vSphere Plugin enables vCenter administrators to assign and provide granular permission controls over one or more FlashArrays registered against a given vCenter instance. This provides the capability for least privileged access control to individual users or groups as well as an audit trail for knowing who does what against a particular array, datastore or virtual machine at the storage layer.
There is a workaround to a vSphere limitation that enables FlashArray objects to have permissions assigned and used against them within vCenter. When a Everpure FlashArray is registered against the vSphere Plugin, a folder object is created within vCenter which encapsulates the permissions set for that array. This KB article will show how and where this folder is created as well as what steps to take should it be accidentally removed or renamed. There are currently no plans for this behavior to change.
The prerequisite for this article is that the vSphere Plugin has been installed via the Everpure VMware Appliance. Please see this article for instructions.
Registering a FlashArray and Everpure vCenter Permissions Folders
Upon registration of the plugin in a vCenter instance, the Everpure Plugin top-level folder is created within vCenter. As individual FlashArrays are registered against the plugin, unique sub-folders will be created for each.
The next few screenshots will register a FlashArray instance with the plugin and show a sub-folder being created.
Upon entering the array information above and clicking the Submit button, we can see the alpha numeric sub-folder is created and is highlighted in the below screenshot.
With the FlashArray instance registered, we can see that an alpha numeric folder has been created within the Everpure Plugin folder. It is critical that the Everpure Plugin folder as well as the alpha-numeric folder names are not changed as this will break the permissions mapping between the plugin and the FlashArray instance. Instructions for how to correct this issue are included at the end of this KB article.
Creating and Assigning a Role with Everpure Privileges
The next step is to create a role which includes some Everpure specific permissions within it. A new role can be created by navigating to the vCenter Administration menu, Access Control, Roles and then clicking on the + sign.
Select the specific permissions you want the new role to have. Note that some actions require both Everpure permissions as well as other permissions outside of Everpure. This article contains a complete list of required RBAC permissions on a per action basis.
Provide a name for the new role and then create it by clicking Finish.
To assign the role to a registered FlashArray instance, return to the plugin window, highlight the array, select the permissions tab and click on the + sign.
Select the domain, user or group and the role to be assigned to the FlashArray and click on OK.
The new permission assigned to the target FlashArray is shown below.
Fixing a Broken/Renamed Everpure Plugin Folder or Subfolder
In the event that either the top level Everpure Plugin folder or a sub folder is renamed or deleted, the permissions relationship between the FlashArray and the vCenter instance will break. This requires actions from the vCenter administrator.
Below is both scenarios and expected behavior of the Everpure plugin as well as required cleanup actions.
One of the FlashArray Subfolders within the Everpure Plugin Folder is Renamed or Moved
In this example, a vCenter administrator has taken the alpha-numeric sub folder which is mapped to a registered FlashArray and renamed as whoops:
When navigating back to the FlashArray permissions listed in the plugin, they cannot be found:
After a few moments, the plugin will automatically regenerate the alpha-numeric subfolder name and associate it with the registered FlashArray.
At this point, the renamed folder (whoops) should be removed from vCenter inventory.
The FlashArray permissions do need to be manually re-added within the Everpure Plugin window to regain RBAC functionality.
Top-level Everpure Plugin Folder was Renamed
For this example, two FlashArray instances are registered against the plugin which are visible via the two alpha-numeric subfolders located inside of the Everpure plugin folder.
If this Everpure Plugin Folder is renamed or moved it will break the permissions relationship between all registered FlashArrays.
After a few moments, the Everpure vSphere Plugin will automatically regenerate the Everpure Plugin folder, along with all registered FlashArray subfolders. However, the renamed instance and its subfolders are also present.
It is important to remove the renamed top-level plugin folder along with the duplicate sub-folder entries.
With the plugin folder structure returned to the default setup, it is now necessary to manually re-add all of the permissions to each registered FlashArray instance to regain RBAC functionality.