Skip to content

Commit 305c8c2

Browse files
tenthirtyamtenthirtyam
authored
docs: update privileges (#688)
- Synchronize the privileges documentation for `vsphere-iso` and `vsphere-clone` builders. - Added Cryptographic Operations privileges required for vTPM. Signed-off-by: Ryan Johnson <ryan.johnson@broadcom.com>
1 parent 47f3b85 commit 305c8c2

4 files changed

Lines changed: 224 additions & 186 deletions

File tree

‎.web-docs/components/builder/vsphere-clone/README.md‎

Lines changed: 69 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1802,56 +1802,72 @@ JSON Example:
18021802

18031803
## Privileges
18041804

1805-
- VM folder (this object and children):
1806-
1807-
```text
1808-
Virtual machine > Inventory
1809-
Virtual machine > Configuration
1810-
Virtual machine > Interaction
1811-
Virtual machine > Snapshot management
1812-
Virtual machine > Provisioning
1813-
```
1814-
1815-
- Resource pool, host, or cluster (this object):
1816-
1817-
```text
1818-
Resource -> Assign virtual machine to resource pool
1819-
```
1820-
1821-
- Host in clusters without DRS (this object):
1822-
1823-
```text
1824-
Read-only
1825-
```
1826-
1827-
- Datastore (this object):
1828-
1829-
```text
1830-
Datastore > Allocate space
1831-
Datastore > Browse datastore
1832-
Datastore > Low level file operations
1833-
```
1834-
1835-
- Network (this object):
1836-
1837-
```text
1838-
Network > Assign network
1839-
```
1840-
1841-
- Distributed switch (this object):
1842-
1843-
```text
1844-
Read-only
1845-
```
1846-
1847-
- Datacenter (this object):
1848-
1849-
```text
1850-
Datastore > Low level file operations
1851-
```
1852-
1853-
- Host (this object):
1854-
1855-
```text
1856-
Host > Configuration > System Management
1857-
```
1805+
It is recommended to create a custom vSphere role with the required privileges to integrate Packer
1806+
with vSphere. Accounts or groups can be added to the role to ensure that Packer has least privilege
1807+
access to the infrastructure.
1808+
1809+
For example, a named service account (_e.g._ `svc-packer-vsphere@example.com`).
1810+
1811+
Clone the default **Read-Only** vSphere role and add the following privileges:
1812+
1813+
| Category | Privilege | Reference |
1814+
| ------------------------ | --------------------------------------------------- | -------------------------------------------------- |
1815+
| Content Library | Add library item | `ContentLibrary.AddLibraryItem` |
1816+
| ... | Update library item | `ContentLibrary.UpdateLibraryItem` |
1817+
| Cryptographic Operations | Direct access | `Cryptographer.Access` |
1818+
| ... | Encrypt | `Cryptographer.Encrypt` |
1819+
| Datastore | Allocate space | `Datastore.AllocateSpace` |
1820+
| ... | Browse datastore | `Datastore.Browse` |
1821+
| ... | Low level file operations | `Datastore.FileManagement` |
1822+
| Network | Assign network | `Network.Assign` |
1823+
| Resource | Assign virtual machine to resource pool | `Resource.AssignVMToPool` |
1824+
| vApp | Export | `vApp.Export` |
1825+
| Virtual Machine | Configuration > Add new disk | `VirtualMachine.Config.AddNewDisk` |
1826+
| ... | Configuration > Add or remove device | `VirtualMachine.Config.AddRemoveDevice` |
1827+
| ... | Configuration > Advanced configuration | `VirtualMachine.Config.AdvancedConfig` |
1828+
| ... | Configuration > Change CPU count | `VirtualMachine.Config.CPUCount` |
1829+
| ... | Configuration > Change memory | `VirtualMachine.Config.Memory` |
1830+
| ... | Configuration > Change settings | `VirtualMachine.Config.Settings` |
1831+
| ... | Configuration > Change Resource | `VirtualMachine.Config.Resource` |
1832+
| ... | Configuration > Set annotation | `VirtualMachine.Config.Annotation` |
1833+
| ... | Edit Inventory > Create from existing | `VirtualMachine.Inventory.CreateFromExisting` |
1834+
| ... | Edit Inventory > Remove | `VirtualMachine.Inventory.Delete` |
1835+
| ... | Interaction > Configure CD media | `VirtualMachine.Interact.SetCDMedia` |
1836+
| ... | Interaction > Configure floppy media | `VirtualMachine.Interact.SetFloppyMedia` |
1837+
| ... | Interaction > Connect devices | `VirtualMachine.Interact.DeviceConnection` |
1838+
| ... | Interaction > Inject USB HID scan codes | `VirtualMachine.Interact.PutUsbScanCodes` |
1839+
| ... | Interaction > Power off | `VirtualMachine.Interact.PowerOff` |
1840+
| ... | Interaction > Power on | `VirtualMachine.Interact.PowerOn` |
1841+
| ... | Provisioning > Clone virtual machine | `VirtualMachine.Provisioning.Clone` |
1842+
| ... | Provisioning > Create template from virtual machine | `VirtualMachine.Provisioning.CreateTemplateFromVM` |
1843+
| ... | Provisioning > Customize guest | `VirtualMachine.Provisioning.Customize` |
1844+
| ... | Provisioning > Deploy template | `VirtualMachine.Provisioning.DeployTemplate` |
1845+
| ... | Provisioning > Mark as template | `VirtualMachine.Provisioning.MarkAsTemplate` |
1846+
| ... | Provisioning > Mark as virtual machine | `VirtualMachine.Provisioning.MarkAsVM` |
1847+
| ... | Snapshot Management > Create snapshot | `VirtualMachine.State.CreateSnapshot` |
1848+
1849+
Global permissions **[are required](https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security-8-0/vsphere-permissions-and-user-management-tasks/understanding-authorization-in-vsphere.html)** for the content library based on the hierarchical inheritance of permissions. Once the custom vSphere role is created, assign **Global Permissions** in vSphere to the accounts or groups used for the Packer to vSphere integration, if using the content library.
1850+
1851+
For example:
1852+
1853+
1. Log in to the vCenter at _https://<vcenter_fqdn>/ui_ as `administrator@vsphere.local`.
1854+
2. Select **Menu** > **Administration**.
1855+
3. In the left pane, select **Access control** > **Global permissions** and click the
1856+
**Add permissions** icon.
1857+
4. In the **Add permissions** dialog box, enter the service account
1858+
(_e.g._ `svc-packer-vsphere@example.com`), select the custom role
1859+
(_e.g._ Packer to vSphere Integration Role) and the **Propagate to children** check box,
1860+
and click **OK**.
1861+
1862+
In an environment with many vCenter instances, such as management and workload, in enhanced
1863+
linked-mode, you may wish to further reduce the scope of access across the vSphere infrastructure if
1864+
you do not want Packer to have access to the management vCenter instance, but only allow
1865+
access to workload vCenter instances.
1866+
1867+
For example:
1868+
1869+
1. From the **Hosts and clusters** inventory, select management vCenter Server to restrict scope,
1870+
and click the **Permissions** tab.
1871+
2. Select the service account with the custom role assigned and click the **Change role** icon.
1872+
3. In the **Change role** dialog box, from the **Role** drop-down menu, select **No Access**, select
1873+
the **Propagate to children** check box, and click **OK**.

‎.web-docs/components/builder/vsphere-iso/README.md‎

Lines changed: 43 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1680,7 +1680,7 @@ Only use the `host` option. Optionally, specify a `resource_pool`:
16801680
HCL Example:
16811681

16821682
```hcl
1683-
host = ""esxi-01.example.com""
1683+
host = "esxi-01.example.com"
16841684
resource_pool = "example_resource_pool"
16851685
```
16861686

@@ -1735,51 +1735,54 @@ access to the infrastructure.
17351735

17361736
For example, a named service account (_e.g._ `svc-packer-vsphere@example.com`).
17371737

1738-
Clone the default **Read-Only** vSphere role and add the following privileges, which are based on
1739-
the capabilities of the `vsphere-iso` plugin:
1740-
1741-
| Category | Privilege | Reference |
1742-
| --------------- | --------------------------------------------------- | -------------------------------------------------- |
1743-
| Content Library | Add library item | `ContentLibrary.AddLibraryItem` |
1744-
| ... | Update Library Item | `ContentLibrary.UpdateLibraryItem` |
1745-
| Datastore | Allocate space | `Datastore.AllocateSpace` |
1746-
| ... | Browse datastore | `Datastore.Browse` |
1747-
| ... | Low level file operations | `Datastore.FileManagement` |
1748-
| Network | Assign network | `Network.Assign` |
1749-
| Resource | Assign virtual machine to resource pool | `Resource.AssignVMToPool` |
1750-
| vApp | Export | `vApp.Export` |
1751-
| Virtual Machine | Configuration > Add new disk | `VirtualMachine.Config.AddNewDisk` |
1752-
| ... | Configuration > Add or remove device | `VirtualMachine.Config.AddRemoveDevice` |
1753-
| ... | Configuration > Advanced configuration | `VirtualMachine.Config.AdvancedConfig` |
1754-
| ... | Configuration > Change CPU count | `VirtualMachine.Config.CPUCount` |
1755-
| ... | Configuration > Change memory | `VirtualMachine.Config.Memory` |
1756-
| ... | Configuration > Change settings | `VirtualMachine.Config.Settings` |
1757-
| ... | Configuration > Change Resource | `VirtualMachine.Config.Resource` |
1758-
| ... | Configuration > Set annotation | `VirtualMachine.Config.Annotation` |
1759-
| ... | Edit Inventory > Create from existing | `VirtualMachine.Inventory.CreateFromExisting` |
1760-
| ... | Edit Inventory > Create new | `VirtualMachine.Inventory.Create` |
1761-
| ... | Edit Inventory > Remove | `VirtualMachine.Inventory.Delete` |
1762-
| ... | Interaction > Configure CD media | `VirtualMachine.Interact.SetCDMedia` |
1763-
| ... | Interaction > Configure floppy media | `VirtualMachine.Interact.SetFloppyMedia` |
1764-
| ... | Interaction > Connect devices | `VirtualMachine.Interact.DeviceConnection` |
1765-
| ... | Interaction > Inject USB HID scan codes | `VirtualMachine.Interact.PutUsbScanCodes` |
1766-
| ... | Interaction > Power off | `VirtualMachine.Interact.PowerOff` |
1767-
| ... | Interaction > Power on | `VirtualMachine.Interact.PowerOn` |
1768-
| ... | Provisioning > Create template from virtual machine | `VirtualMachine.Provisioning.CreateTemplateFromVM` |
1769-
| ... | Provisioning > Mark as template | `VirtualMachine.Provisioning.MarkAsTemplate` |
1770-
| ... | Provisioning > Mark as virtual machine | `VirtualMachine.Provisioning.MarkAsVM` |
1771-
| ... | State > Create snapshot | `VirtualMachine.State.CreateSnapshot` |
1738+
Clone the default **Read-Only** vSphere role and add the following privileges:
1739+
1740+
| Category | Privilege | Reference |
1741+
| ------------------------ | --------------------------------------------------- | -------------------------------------------------- |
1742+
| Content Library | Add library item | `ContentLibrary.AddLibraryItem` |
1743+
| ... | Update library Item | `ContentLibrary.UpdateLibraryItem` |
1744+
| Cryptographic Operations | Direct access | `Cryptographer.Access` |
1745+
| ... | Encrypt | `Cryptographer.Encrypt` |
1746+
| Datastore | Allocate space | `Datastore.AllocateSpace` |
1747+
| ... | Browse datastore | `Datastore.Browse` |
1748+
| ... | Low level file operations | `Datastore.FileManagement` |
1749+
| Network | Assign network | `Network.Assign` |
1750+
| Resource | Assign virtual machine to resource pool | `Resource.AssignVMToPool` |
1751+
| vApp | Export | `vApp.Export` |
1752+
| Virtual Machine | Configuration > Add new disk | `VirtualMachine.Config.AddNewDisk` |
1753+
| ... | Configuration > Add or remove device | `VirtualMachine.Config.AddRemoveDevice` |
1754+
| ... | Configuration > Advanced configuration | `VirtualMachine.Config.AdvancedConfig` |
1755+
| ... | Configuration > Change CPU count | `VirtualMachine.Config.CPUCount` |
1756+
| ... | Configuration > Change memory | `VirtualMachine.Config.Memory` |
1757+
| ... | Configuration > Change settings | `VirtualMachine.Config.Settings` |
1758+
| ... | Configuration > Change Resource | `VirtualMachine.Config.Resource` |
1759+
| ... | Configuration > Set annotation | `VirtualMachine.Config.Annotation` |
1760+
| ... | Edit Inventory > Create from existing | `VirtualMachine.Inventory.CreateFromExisting` |
1761+
| ... | Edit Inventory > Create new | `VirtualMachine.Inventory.Create` |
1762+
| ... | Edit Inventory > Remove | `VirtualMachine.Inventory.Delete` |
1763+
| ... | Interaction > Configure CD media | `VirtualMachine.Interact.SetCDMedia` |
1764+
| ... | Interaction > Configure floppy media | `VirtualMachine.Interact.SetFloppyMedia` |
1765+
| ... | Interaction > Connect devices | `VirtualMachine.Interact.DeviceConnection` |
1766+
| ... | Interaction > Inject USB HID scan codes | `VirtualMachine.Interact.PutUsbScanCodes` |
1767+
| ... | Interaction > Power off | `VirtualMachine.Interact.PowerOff` |
1768+
| ... | Interaction > Power on | `VirtualMachine.Interact.PowerOn` |
1769+
| ... | Provisioning > Create template from virtual machine | `VirtualMachine.Provisioning.CreateTemplateFromVM` |
1770+
| ... | Provisioning > Mark as template | `VirtualMachine.Provisioning.MarkAsTemplate` |
1771+
| ... | Provisioning > Mark as virtual machine | `VirtualMachine.Provisioning.MarkAsVM` |
1772+
| ... | Snapshot Management > Create snapshot | `VirtualMachine.State.CreateSnapshot` |
17721773

17731774
Global permissions **[are required](https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security-8-0/vsphere-permissions-and-user-management-tasks/understanding-authorization-in-vsphere.html)** for the content library based on the hierarchical inheritance of permissions. Once the custom vSphere role is created, assign **Global Permissions** in vSphere to the accounts or groups used for the Packer to vSphere integration, if using the content library.
17741775

17751776
For example:
17761777

1777-
1. Log in to the vCenter Server at _https://<management_vcenter_server_fqdn>/ui_ as `administrator@vsphere.local`.
1778+
1. Log in to the vCenter at _https://<vcenter_fqdn>/ui_ as `administrator@vsphere.local`.
17781779
2. Select **Menu** > **Administration**.
1779-
3. In the left pane, select **Access control** > **Global permissions** and click the **Add permissions** icon.
1780-
4. In the **Add permissions** dialog box, enter the service account (_e.g._
1781-
`svc-packer-vsphere@example.com`), select the custom role (_e.g._ Packer to vSphere Integration
1782-
Role) and the **Propagate to children** check box, and click **OK**.
1780+
3. In the left pane, select **Access control** > **Global permissions** and click the
1781+
**Add permissions** icon.
1782+
4. In the **Add permissions** dialog box, enter the service account
1783+
(_e.g._ `svc-packer-vsphere@example.com`), select the custom role
1784+
(_e.g._ Packer to vSphere Integration Role) and the **Propagate to children** check box,
1785+
and click **OK**.
17831786

17841787
In an environment with many vCenter instances, such as management and workload, in enhanced
17851788
linked-mode, you may wish to further reduce the scope of access across the vSphere infrastructure if

0 commit comments

Comments
 (0)