ONTAP tools for VMware vSphere 10 Manuals ( CA08871-301 )
Configure ONTAP user roles and privileges
You can configure new user roles and privileges for managing storage backends using ONTAP System Manager.
SVM aggregate mapping requirements
When provisioning datastores using SVM user credentials, ONTAP tools for VMware vSphere creates volumes on the aggregate specified in the datastores POST API. ONTAP prevents SVM users from creating volumes on aggregates not mapped to the SVM. Map the SVM to the required aggregates using the ONTAP REST API or CLI before creating volumes.
REST API:
PATCH "/api/svm/svms/f16f0935-5281-11e8-b94d-005056b46485" '{"aggregates":{"name":["aggr1","aggr2","aggr3"]}}'
ONTAP CLI:
sti115_vsim_ucs630f_aggr1 vserver show-aggregates AvailableVserver Aggregate State Size Type SnapLock Type-------------- -------------- ------- ---------- ------- --------------svm_test sti115_vsim_ucs630f_aggr1 online 10.11GB vmdisk non-snaplock
Create ONTAP user and role manually
Follow the instructions in this section to create the user and roles manually.
-
Access ONTAP System Manager using the cluster management IP address of the cluster.
-
Log in to the cluster with admin privileges.
-
To configure cluster ONTAP tools roles, select Cluster > Settings > Users and Roles.
-
To configure cluster SVM ONTAP tools roles, select Storage SVM > Settings > Users and Roles.
-
-
Create roles:
-
Select Add under Roles table.
-
Enter the Role name and Role Attributes details.
Add the REST API Path and choose the access from the drop-down list.
-
Add all the needed APIs and save the changes.
-
-
Create users:
-
Select Add under Users table.
-
In the Add User dialog box, select System Manager.
-
Enter the Username.
-
Select Role from the options created in the Create Roles step above.
-
Enter the applications to give access to and the authentication method. ONTAPI and HTTP are the required applications, and the authentication type is Password.
-
Set the Password for the User and Save the user.
-
List of minimum privileges required for non-admin global scoped cluster user
The minimum privileges required for non-admin global scoped cluster user are listed in this section.
You can access functionality by using APIs:
API |
Access level |
Used for |
/api/cluster |
Read-Only |
Cluster configuration discovery |
/api/cluster/licensing/licenses |
Read-Only |
License Check for protocol specific licenses |
/api/cluster/nodes |
Read-Only |
Platform type discovery |
/api/security/accounts |
Read-Only |
Privilege discovery |
/api/security/roles |
Read-Only |
Privilege discovery |
/api/storage/aggregates |
Read-Only |
Aggregate space check during datastore/volume provisioning |
/api/storage/cluster |
Read-Only |
To get the cluster level space and efficiency data |
/api/storage/disks |
Read-Only |
To get the disks associated in an aggregate |
/api/storage/qos/policies |
Read/Create/Modify |
QoS and VM policy management |
/api/svm/svms |
Read-Only |
To get SVM configuration when the cluster is added locally. |
/api/network/ip/interfaces |
Read-Only |
Add storage backend - To identify the management LIF scope is cluster/SVM |
/api/storage/availability-zones |
Read-Only |
SAZ discovery. Applicable to ONTAP 9.16.1 release onwards and ASA r2 systems. |
/api/cluster/metrocluster |
Read-Only |
Gets MetroCluster status and configuration details. |
Create ONTAP tools for VMware vSphere ONTAP API based cluster scoped user
| Discovery, create, modify, and destroy privileges are required for PATCH operations and automatic rollback on datastores. Missing permissions might cause workflow and cleanup issues. |
An ONTAP API-based user with discovery, create, modify, and destroy privileges can manage ONTAP tools workflows.
To create a cluster scoped user with all privileges mentioned above, run the following commands:
security login rest-role create -role <role-name> -api /api/application/consistency-groups -access all security login rest-role create -role <role-name> -api /api/private/cli/snapmirror -access all security login rest-role create -role <role-name> -api /api/protocols/nfs/export-policies -access all security login rest-role create -role <role-name> -api /api/protocols/nvme/subsystem-maps -access all security login rest-role create -role <role-name> -api /api/protocols/nvme/subsystems -access all security login rest-role create -role <role-name> -api /api/protocols/san/igroups -access all security login rest-role create -role <role-name> -api /api/protocols/san/lun-maps -access all security login rest-role create -role <role-name> -api /api/protocols/san/vvol-bindings -access all security login rest-role create -role <role-name> -api /api/snapmirror/relationships -access all security login rest-role create -role <role-name> -api /api/storage/volumes -access all security login rest-role create -role <role-name> -api "/api/storage/volumes/*/snapshots" -access all security login rest-role create -role <role-name> -api /api/storage/luns -access all security login rest-role create -role <role-name> -api /api/storage/namespaces -access all security login rest-role create -role <role-name> -api /api/storage/qos/policies -access all security login rest-role create -role <role-name> -api /api/cluster/schedules -access read_create security login rest-role create -role <role-name> -api /api/snapmirror/policies -access read_create security login rest-role create -role <role-name> -api /api/storage/file/clone -access read_create security login rest-role create -role <role-name> -api /api/storage/file/copy -access read_create security login rest-role create -role <role-name> -api /api/support/ems/application-logs -access read_create security login rest-role create -role <role-name> -api /api/protocols/nfs/services -access read_modify security login rest-role create -role <role-name> -api /api/cluster -access readonly security login rest-role create -role <role-name> -api /api/cluster/jobs -access readonly security login rest-role create -role <role-name> -api /api/cluster/licensing/licenses -access readonly security login rest-role create -role <role-name> -api /api/cluster/nodes -access readonly security login rest-role create -role <role-name> -api /api/cluster/peers -access readonly security login rest-role create -role <role-name> -api /api/name-services/name-mappings -access readonly security login rest-role create -role <role-name> -api /api/network/ethernet/ports -access readonly security login rest-role create -role <role-name> -api /api/network/fc/interfaces -access readonly security login rest-role create -role <role-name> -api /api/network/fc/logins -access readonly security login rest-role create -role <role-name> -api /api/network/fc/ports -access readonly security login rest-role create -role <role-name> -api /api/network/ip/interfaces -access readonly security login rest-role create -role <role-name> -api /api/protocols/nfs/kerberos/interfaces -access readonly security login rest-role create -role <role-name> -api /api/protocols/nvme/interfaces -access readonly security login rest-role create -role <role-name> -api /api/protocols/san/fcp/services -access readonly security login rest-role create -role <role-name> -api /api/protocols/san/iscsi/services -access readonly security login rest-role create -role <role-name> -api /api/security/accounts -access readonly security login rest-role create -role <role-name> -api /api/security/roles -access readonly security login rest-role create -role <role-name> -api /api/storage/aggregates -access readonly security login rest-role create -role <role-name> -api /api/storage/cluster -access readonly security login rest-role create -role <role-name> -api /api/storage/disks -access readonly security login rest-role create -role <role-name> -api /api/storage/qtrees -access readonly security login rest-role create -role <role-name> -api /api/storage/quota/reports -access readonly security login rest-role create -role <role-name> -api /api/storage/snapshot-policies -access readonly security login rest-role create -role <role-name> -api /api/svm/peers -access readonly security login rest-role create -role <role-name> -api /api/svm/svms -access readonly security login rest-role create -role <role-name> -api /api/cluster/metrocluster -access readonly
Additionally, for ONTAP Versions 9.16.0 and above run the following command:
security login rest-role create -role <role-name> -api /api/storage/storage-units -access all
Create ONTAP tools for VMware vSphere ONTAP API based SVM scoped user
Run the following commands to create an SVM scoped user with all privileges:
security login rest-role create -role <role-name> -api /api/application/consistency-groups -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/private/cli/snapmirror -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/nfs/export-policies -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/nvme/subsystem-maps -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/nvme/subsystems -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/san/igroups -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/san/lun-maps -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/san/vvol-bindings -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/snapmirror/relationships -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/volumes -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api "/api/storage/volumes/*/snapshots" -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/luns -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/namespaces -access all -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/cluster/schedules -access read_create -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/snapmirror/policies -access read_create -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/file/clone -access read_create -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/file/copy -access read_create -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/support/ems/application-logs -access read_create -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/nfs/services -access read_modify -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/cluster -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/cluster/jobs -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/cluster/peers -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/name-services/name-mappings -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/network/ethernet/ports -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/network/fc/interfaces -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/network/fc/logins -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/network/ip/interfaces -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/nfs/kerberos/interfaces -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/nvme/interfaces -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/san/fcp/services -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/protocols/san/iscsi/services -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/security/accounts -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/security/roles -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/qtrees -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/quota/reports -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/storage/snapshot-policies -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/svm/peers -access readonly -vserver <vserver-name> security login rest-role create -role <role-name> -api /api/svm/svms -access readonly -vserver <vserver-name>
Additionally, for ONTAP Versions 9.16.0 and above run the following command:
security login rest-role create -role <role-name> -api /api/storage/storage-units -access all -vserver <vserver-name>
To create a new API based user using the above created API based roles, run the following command:
security login create -user-or-group-name <user-name> -application http -authentication-method password -role <role-name> -vserver <cluster-or-vserver-name>
Example:
security login create -user-or-group-name testvpsraall -application http -authentication-method password -role OTV_10_VP_SRA_Discovery_Create_Modify_Destroy -vserver C1_sti160-cluster_
Run the following command to unlock the account and enable management interface access:
security login unlock -user <user-name> -vserver <cluster-or-vserver-name>
Example:
security login unlock -username testvpsraall -vserver C1_sti160-cluster
