Skip to content

Commit

Permalink
chore: Merge branch 'chore/vsphere-privileges' of https://github.com/…
Browse files Browse the repository at this point in the history
…spectrocloud/librarium into chore/vsphere-privileges
  • Loading branch information
TylerGillson committed Sep 5, 2024
2 parents be2e138 + 5275309 commit 18a40eb
Show file tree
Hide file tree
Showing 4 changed files with 26 additions and 13 deletions.
12 changes: 6 additions & 6 deletions docs/docs-content/clusters/data-center/vmware/permissions.md
Original file line number Diff line number Diff line change
Expand Up @@ -102,8 +102,8 @@ all required privileges on all required objects.
### Spectro Role Privileges

The VMware vSphere user account that deploys host clusters and/or private cloud gateways requires all vSphere privileges
listed in the following table on specific objects. A _Spectro role_ must be created that contains each privilege in
the following tables. A separate table lists Spectro role privileges for VMs by category.
listed in the following table on specific objects. A _Spectro role_ must be created that contains each privilege in the
following tables. A separate table lists Spectro role privileges for VMs by category.

Select the tab for the vSphere version you are using to view the required privileges for the _Spectro role_.

Expand Down Expand Up @@ -221,14 +221,14 @@ The following table lists _Spectro role_ privileges for VMs by category. All pri

### Spectro Role Assignments

The privileges associated with the _Spectro role_ must be granted via role assignments on specific vSphere objects
for either the user or a group containing the user. Review the required role assignments to ensure that your user has
all required privileges on all required objects.
The privileges associated with the _Spectro role_ must be granted via role assignments on specific vSphere objects for
either the user or a group containing the user. Review the required role assignments to ensure that your user has all
required privileges on all required objects.

| **vSphere Object** | **Propagation** | **Role** |
| -------------------------------------------- | --------------- | -------------- |
| **Target Network** | Yes | _Spectro role_ |
| **Target Datastore** | Yes | _Spectro role_ |
| **All ESXi hosts within the Target Cluster** | No | _Spectro role_ |
| **Target Resource Pool** | Yes | _Spectro role_ |
| **spectro-templates Folder** | Yes | _Spectro role_ |
| **spectro-templates Folder** | Yes | _Spectro role_ |
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,16 @@ to create an IaaS Kubernetes cluster in Azure that Palette manages.
- Managed Disks
- Virtual Network Address Translation (NAT) Gateway

- To enable the `fullyPrivateAddressing` parameter, you need a self-hosted Private Cloud Gateway (PCG) deployed in
Azure. For more information on deploying PCGs, refer to [Private Cloud Gateway](../../pcg/pcg.md).
- To enable the `fullyPrivateAddressing` parameter and use a Private API Server load balancer, you need a self-hosted
Private Cloud Gateway (PCG) deployed in Azure. Ensure the Azure cloud account selected is connected to a PCG. For more
information on deploying PCGs, refer to [Private Cloud Gateway](../../pcg/pcg.md). To learn how to connect a PCG to an
Azure cloud account, refer to the [Register and Manage Azure Cloud Account](./azure-cloud.md) guide.

- A Private DNS Zone is required to use the Private API Server load balancer. You also need to ensure the vNETs used for
the cluster supports
[Private DNS resolving](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview). To learn more
about Private DNS Zones, refer to
[Private DNS Zones](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns).

## Deploy an Azure Cluster

Expand Down Expand Up @@ -98,8 +106,6 @@ Use the following steps to deploy an Azure cluster.
If you set the `fullyPrivateAddressing` property to `false` or leave it blank, Palette will create outbound load
balancers for the control plane and worker nodes and assign public IPs to them.

:::warning

Consider the following limitations:

- If the `fullyPrivateAddressing` parameter is set to `true`, the control plane and worker nodes in your cluster must
Expand All @@ -110,7 +116,10 @@ Use the following steps to deploy an Azure cluster.
- Once the `fullyPrivateAddressing` parameter is set for your cluster, you cannot change its value. Changing the
parameter value will result in errors until you return the value to its original configuration.

:::
Toggle the **Private API Server LB** option to enable the use of a Private API Server load balancer and specify the
[Private DNS Zone](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns) name you want to use.
Select the desired **IP Allocation Method**. You can choose between **Static** and **Dynamic** IP allocation methods.
If you select **Static**, you must provide a valid IP address.

10. To configure custom OpenID Connect (OIDC) for Azure clusters, refer to our
[Configure OIDC Identity Provider](../../../integrations/kubernetes.md#configure-oidc-identity-provider) guide for
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ Palette requires two custom roles to be created in vSphere before the installati
guide if you need help creating a custom role in vSphere. The required custom roles are:

- A root-level role with access to higher-level vSphere objects. This role is referred to as the _Spectro root role_.
Check out the [Root-Level Role Privileges](../../../clusters/data-center/vmware/permissions.md#spectro-root-role-privileges) table for the list of privileges required for the root-level role.
Check out the
[Root-Level Role Privileges](../../../clusters/data-center/vmware/permissions.md#spectro-root-role-privileges) table
for the list of privileges required for the root-level role.

- A role with the required privileges for deploying VMs. This role is referred to as the _Spectro role_. Review the
[Spectro Role Privileges](../../../clusters/data-center/vmware/permissions.md#spectro-role-privileges) table for the
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@ VerteX requires two custom roles to be created in vSphere before the installatio
guide if you need help creating a custom role in vSphere. The required custom roles are:

- A root-level role with access to higher-level vSphere objects. This role is referred to as the _Spectro root role_.
Check out the [Root-Level Role Privileges](../../../clusters/data-center/vmware/permissions.md#spectro-root-role-privileges) table for the list of privileges required for the root-level role.
Check out the
[Root-Level Role Privileges](../../../clusters/data-center/vmware/permissions.md#spectro-root-role-privileges) table
for the list of privileges required for the root-level role.

- A role with the required privileges for deploying VMs. This role is referred to as the _Spectro role_. Review the
[Spectro Role Privileges](../../../clusters/data-center/vmware/permissions.md#spectro-role-privileges) table for the
Expand Down

0 comments on commit 18a40eb

Please sign in to comment.