Re: SVM Admin Access

Phil,

So that level of control/access is at the Cluster level and not at the SVM
level. If you want to do something like this with delegated access, WFA is
definitely one way. Other alternatives is to use automation via Ansible in
conjunction with Ansible Tower. There you can use predefined playbooks to
perform the operations that you want, using naming standard that you want.
And, use Ansible Tower to control who has the rights to execute the
playbooks at certain levels.

Regards,
André M. Clark

On September 23, 2020 at 09:51:14, Rupkins Philbert (
[email protected]) wrote:

Hello,

Thanks for the responses. I should have included more details, apologies.

Environment:
* ONTAP 9.3 P19 (9.7 by EoY)
* Windows Server 2008/2012/2016
* vSphere 6.0 (6.7 by EoY)
* RHEL7/8 based Linux hosts

The following summarizes the SVM scoped privs we'd like them to have
via System Manager:

* Provision RW Flexvols
* Create Junction Paths
* Provision DR Flexvols
* Provision CIFS Shares
* Configure CIFS share permissions
* Provision NFS exports
* Configure export policies
* Manage local SVM user accounts (multiprotocol access / user mappings)
* Create and manage Snapmirror relationships
* Create and manage snapshot policies

We'd like to stay away from delegating cluster level privs so no need
for them to create SVM's , LIF's, etc - the platform team will
continue to do that.

We do use VSC today. But that doesnt address general use CIFS shares
and NFS exports.

My understanding is WFA is being retired. Is this not true?

Cheers,
Phil

On Wed, Sep 23, 2020 at 8:23 AM tmac <[email protected]> wrote:
>
> Might want to take a look at installing OnCommand Worfklow Automation.
> I suspect this may allow you to do what you need. Some YouTube videos:
> Technical Introduction
> OnCommand Workflow Automation Introduction
>
> Product page:
https://mysupport.netapp.com/site/products/all/details/ocwfa/downloads-tab
>
>
> --tmac
>
> Tim McCarthy, Principal Consultant
>
> Proud Member of the #NetAppATeam
>
> I Blog at TMACsRack
>
>
>
>
> On Wed, Sep 23, 2020 at 2:04 AM Alexander Griesser <
[email protected]> wrote:
>>
>> Hey,
>>
>> what exactly are the requirements? What do you need them to do, when you
say "provision storage"?
>> Should they just be able to create new shares on already existing
volumes or do they need to create new volumes, new LIFs, local user
accounts, etc.?
>>
>> Best,
>>
>> Alexander Griesser
>> System-Administrator
>>
>> ANEXIA Internetdienstleistungs GmbH
>>
>> Telefon: +43-463-208501-320
>> Telefax: +43-463-208501-500
>>
>> E-Mail: [email protected]
>> Web: http://www.anexia.at
>>
>> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt
>> Geschäftsführer: Alexander Windbichler
>> Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT
U63216601
>>
>> -----Ursprüngliche Nachricht-----
>> Von: Toasters <[email protected]> Im Auftrag von Philbert
Rupkins
>> Gesendet: Mittwoch, 23. September 2020 00:25
>> An: Toasters <[email protected]>
>> Betreff: SVM Admin Access
>>
>> Toasters,
>>
>> I work with a team of Windows Server admins who are open to
>> provisioning their own storage but strongly prefer a GUI. I'd like
>> to provide this ability by granting System Manager access to the
specific SVM's that host their resources.
>>
>> Much to my chagrin, it doesn't appear RBAC allows for System Manager
>> access to particular SVMs. Instead, privileges must be granted at
>> the cluster level which of course means those privs are effective for
all data SVMs (this is a non-starter).
>>
>> Per NetApp docs, my only option appears to be SVM level RBAC privs via
SSH. Not quite the GUI option they are looking for but, organizationally,
we're making a push for more automation and use of Ansible so it's not
completely out of the question.
>>
>> Is there an angle Im not considering that would allow for SVM level
>> access via System Manager? Has anybody else come up with creative
>> ways to address this problem?
>>
>> I'd love to hear from you.
>>
>> Thanks,
>> Phil
>> _______________________________________________
>> Toasters mailing list
>> [email protected]
>> https://www.teaparty.net/mailman/listinfo/toasters
>>
>> _______________________________________________
>> Toasters mailing list
>> [email protected]
>> https://www.teaparty.net/mailman/listinfo/toasters

_______________________________________________
Toasters mailing list
[email protected]
https://www.teaparty.net/mailman/listinfo/toasters

_______________________________________________
Toasters mailing list
[email protected]
https://www.teaparty.net/mailman/listinfo/toasters