Make vCenter Plug-in Read-Only

[jeberhardt42]

Is there a way to install the vCenter plug-in, but make it read-only so no changes can be made within? We have 2 accounts configured on each of our SANs that we deploy for customers, 1 for our engineers (full admin) and one for our support techs (read-only). I would prefer that the plug-in into vCenter acts the same way as the read-only account where our support techs are able to look at volumes and view statistical information, but not modify them.

We have all vCenter servers configured with active directory integration and currently, the AD account that we use to install the plug-in is a vCenter admin. I was going to try to put that user account into a read-only group within the vCenter server, but I wasn't sure if that user would be able to install the plug-in at that time and it would break or not even install.

Has anyone tried this before and had it work as i'm describing?

Thanks everyone

[marktheblue45 · Accepted solution]

Hi Joe, Just go into the Vcentre Permission for the Nimble storage extension and you can change its permissions for a particular role. I have a role called Vcentre_SAN_Admin that has full permissions whereas general Vcentre Admins or lesser have only browse. It is flexible and my initial concern was the same as yours. Regards, Mark.

[marktheblue45]

Create a Role like Vcentre SAN Admin first with FULL permissions. Add the appropriate users to that and then tune the other roles to not have full monty to the Nimble plugin for vCentre. I appreciate the default role Admin is not tuneable.

[jeberhardt42]

EXCELLENT! Thank you Mark, this is exactly what I was looking for. I didn't realize that we could manage the extension in that way to be able to trim down the functions. I'm going to play around with some of the settings to see what else I can configure with it but again, perfect answer!