I have 5 servers running ESXi, they are managed by vCenter. I want to setup resource pools for various IT admins from each department, and limit them to create and manage VM’s in their own resource pool, and not be able to see other resource pools/VMs/etc. I am running ESXi 5.0.
I was able to create the resource pools under each ESXi host. For each pool I set reservations and maximum allowances for resource utilization.
I then set permissions for users on each resource pool.
As it stands, each user can log in and only see their own resource pool and virtual machines. However they can also create virtual machines directly under the host, when I try to apply the “no-access” permission to the host, they can’t create VMs in their resource pool. Even when I click to not propagate the rule. I can't restrict them from the ESXi host directly or else they can't use their resource pool.
Further, the reservations/maximum limits I set for each resource pool don’t seem to matter when I login as a user and go to create a VM, it let's me create something well out of the tolerances supposedly set in the resource pool. For example, I can set reserved RAM to 8 GB, then the set the max expandable RAM to 12 GB, but then the user can still create a VM with 16 GB RAM.
Anyone know the best way to go about restricting users to their resource pools and not allowing them to allocate resources for a VM they should not be allowed?