Community

Limiting a user's privileges to adding resources?

Is there a way to set a DCD user's permissions to add resources (CPU, RAM, disk space, etc) only? I don't want the user to have the ability to delete resources, only add them.

Thanks.

 
  • **bold**
  • _italics_
  • `code`
  • ```code block```
  • # Heading 1
  • ## Heading 2
  • > Quote
 

Hello Victorio,

I wanted to make sure I fully understand the question.

Are you looking for a way to give a user 'read-only' access to a virtual data center and any resources in it, but then have the ability to increase specific server resources only? Is the intended use that this limited user could boost the available server resources until somebody with full permissions could address the situation?

Eric

Hi Eric,

I think you've got it. For our most immediate usage case we want operators to be able to scale up drive space and add drives via an API script. It would be nice to have the same for cores and RAM. We're most concerned about not allowing drives to be deleted through the API user as that would result in data loss. Reducing resources would require a different user with full permissions which would not be accessible via the API script operators use.

Thanks,

Victorio

Okay - well I'm sorry to report that the permission set that you are asking about isn't currently available. If a user has "edit" rights to the resources, they are also able to delete them. I've heard that a more granular permissions system was discussed, but there aren't any plans to implement it in the near future.

Thanks for elaborating on the use case. I don't have a great solution to offer right at the moment. You may have already considered integrating snapshots into your workflow. Having snapshot(s) available would provide an extra layer of safety if something happened to go awry with the API script (or operators).

Bummer. We do use snapshots for engineering changes in case something goes wrong but were hoping to prevent that possibility for operators via permissions. The downside of snapshots for our implementation is that we would have to wait what could be a few hours for the snapshot to finish before any API change is applied. I assume we'd also need to take the drive and any applications which use the drive offline while the snapshot is running if we want to get a clean snapshot.