2

I have 5 servers running ESXi, they are managed by vCenter. I want to setup resource pools for various IT admins from each department, and limit them to create and manage VM’s in their own resource pool, and not be able to see other resource pools/VMs/etc. I am running ESXi 5.0.

I was able to create the resource pools under each ESXi host. For each pool I set reservations and maximum allowances for resource utilization.

I then set permissions for users on each resource pool.

As it stands, each user can log in and only see their own resource pool and virtual machines. However they can also create virtual machines directly under the host, when I try to apply the “no-access” permission to the host, they can’t create VMs in their resource pool. Even when I click to not propagate the rule. I can't restrict them from the ESXi host directly or else they can't use their resource pool.

Further, the reservations/maximum limits I set for each resource pool don’t seem to matter when I login as a user and go to create a VM, it let's me create something well out of the tolerances supposedly set in the resource pool. For example, I can set reserved RAM to 8 GB, then the set the max expandable RAM to 12 GB, but then the user can still create a VM with 16 GB RAM.

Anyone know the best way to go about restricting users to their resource pools and not allowing them to allocate resources for a VM they should not be allowed?

1
+100

Not knowing your exact configuration in regards to user permissions etc, i can only make educated guesses with the data we've been given.

If the following criteria are what you are looking for then the admins should be granted Resource Pool Administrator permissions at the Resource Pool Level.

  • Allows user to create child resource pools and modify configuration of the children, but cannot modify configuration for the pool or cluster where the permission was granted.
  • User can grant permissions to child resource pools and assign VMs to the parent or the child.
  • All privileges for folder, virtual machine, alarms, and scheduled task privileges groups.
  • Selected privileges for resource and permissions privileges groups.
  • No privileges for datacenter, network, host, sessions, or performance privileges groups.
  • Additional privileges must be granted on virtual machines and datastores to allow provisioning of new virtual machines.

I would strongly suggest creating a new user as a testing base, and try applying permissions only to this user (it may require using Resource Pool Admin as a base and customizing).

Once you have found the correct configuration, I recommend placing the users in a group and applying the permissions to the group (less admin overhead when changes need to be made).

It may pay to try applying the test user's permissions at different levels, and consider creating a Child Resource Pool in each Resource Pool you have and apply the permissions to them to see if that has any effect

**Don't forget to apply propagation to the permissions (it only goes down the hierarchy).

From what i have read, whilst they will be able to create machines with 16GB ram despite your max limit of 12GB, the VM will only ever be allowed to use a total of 12GB from the Resource Pool, after that the VM starts on a rather messy system of using something akin to pagefiles and memory swapping.

**My memory could be entirely wrong on this so don't treat it as gospel.

1
  • This has set me in the right direction for the permissions! Thanks for your assistance! My issue was trying to do permission directly from the ESX level. When I did the permissions from the vCenter level I was able to utilize the Resource Pool Administrator role correctly and the admins are only able to play in their sandbox. I will worry about the resource pools after some stress testing further. Thanks Nick!
    – 0xhughes
    Mar 29 '14 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.