Service account requirements

To use the vSphere provider in the Shturval platform, you must have a service account and service roles in the virtualization platform with VMware vSphere 6.7 update 3 or 7.0 and higher. Create a resource pool and prepare account credentials.

Note! Enter the service account in username@domain format.

Assign the following roles to the vSphere provider account:

custom role with service role #1 permissions;
system role Read only ;
if CSI is required, additionally assign a second custom role with service role #2 permissions. This is an auxiliary role; an account with only this role will not have all required permissions.

If separate CSI permissions are required, for example when the cluster does not use the vSphere provider, create a new account and custom roles for vSphere CSI.

Note! For correct connection, configure service account permissions as recommended. If you grant full permissions to the service account, every Datacenter the account can access must have a Datastore

Rights assignment scheme

Object	Role	Propagation (inheritance)	Comment
vCenter	Service role #2	No	vCenter where client cluster VMs run. Required for CSI
Datacenter	Read only	No	Datacenter for client cluster VMs
Cluster	Service role #1	No	Cluster for client cluster VMs
Host	Read only	No	On all hosts in the cluster where client cluster VMs run. Required for CSI
Resource pool	Service role #1	Yes (optional)	Resource pool for client cluster VMs
Folder	Service role #1	Yes	Folder for client cluster VMs and the template they are created from
Datastore	Service role #1	Yes	Datastore for client cluster VM disks
Distributed Switch	Read only	No	Distributed switch for client cluster VM network interfaces
Distributed Port Group	Service role #1	Yes	Distributed port group for client cluster VM network interfaces. Permissions must include the port group connected to the VM template network interface

Permissions for service role #1

HTML Table

Category	Permission
Datastore	Allocate space
	Browse datastore
	Low level file operations
	Remove file
	Update virtual machine files
	Update virtual machine metadata
Folder	Create folder
	Delete folder
	Move folder
	Rename folder
Global	Cancel task
	Log event
	Set custom attribute
Host	Local operations: Create virtual machine Delete virtual machine Reconfigure virtual machine
Network	Assign network
Resource	Apply recommendation
	Assign vApp to resource pool
	Assign virtual machine to resource pool
	Create resource pool
	Migrate powered off virtual machine
	Migrate powered on virtual machine
	Move resource pool
	Query vMotion
	Remove resource pool
Scheduled task	Create tasks
	Modify task
	Remove task
	Run task
Profile-driven storage	Profile-driven storage view
Tasks	Create task
Tasks	Update task
vApp Actions	Add virtual machine
	Assign resource pool
	Assign vApp
	Clone
	Create
	Delete
	Export
	Import
	Move
	Power off
	Power on
	Pull from URL
	Rename
	Suspend
	Unregister
	View OVF environment
	vApp application configuration
	vApp instance configuration
	vApp managedBy configuration
	vApp resource configuration
Virtual machine	Change Configuration: Acquire disk lease Add existing disk Add new disk Add or remove device Advanced configuration Change CPU count Change Memory Change Settings Change Swapfile placement Change resource Configure Host USB device Configure Raw device Configure managedBy Display connection settings Extend virtual disk Modify device settings Query Fault Tolerance compatibility Query unowned files Reload from path Remove disk Rename Reset guest information Set annotation Toggle disk change tracking Toggle fork parent Upgrade virtual machine compatibility
	Edit Inventory: Create from existing Create new Move Register Remove Unregister
	Guest operations: Guest operation alias modification Guest operation alias query Guest operation modifications Guest operation program execution Guest operation queries
	Interaction: Answer question Backup operation on virtual machine Configure CD media Configure floppy media Connect devices Console interaction Create screenshot Defragment all disks Drag and drop Guest operating system management by VIX API Inject USB HID scan codes Install VMware Tools Pause or Unpause Perform wipe or shrink operations Power off Power on Record session on virtual machine Replay session on virtual machine Reset Resume Fault Tolerance Suspend Suspend Fault Tolerance Suspend to memory Test failover Test restart Secondary VM Turn off Fault Tolerance Turn on Fault Tolerance
	Provisioning: Allow disk access Allow file access Allow read-only disk access Allow virtual machine download Allow virtual machine files upload Clone template Clone virtual machine Create template from virtual machine Customize guest Deploy template Mark as template Mark as virtual machine Modify customization specification Promote disks Read customization specifications
	Snapshot management: Create snapshot Remove snapshot Rename snapshot Revert to snapshot

Permissions for service role #2

HTML Table

Category	Permission
CNS	Searchable
Profile-driven storage	Profile-driven storage update
Profile-driven storage	Profile-driven storage view
Sessions	View and stop sessions
Sessions	Validate session

Account and roles for vSphere CSI

When a cluster (not using the vSphere provider) needs vSphere cloud storage, create a separate account with the required roles. Use such an account, for example, in a cluster with the Shturval v2 provider when installing vSphere CSI.

Rights assignment scheme for vSphere CSI

Object	Role	Propagation (inheritance)	Comment
Datastore	CNS-DATASTORE	No	Datastore for client cluster VM disks
vCenter	CNS-SEARCH-AND-SPBM	No	vCenter where client cluster VMs run
Folder	CNS-VM	Yes	Folder containing client cluster VMs
Datacenter	CNS-HOST-CONFIG-STORAGE	No	Datacenter containing client cluster VMs
Cluster	CNS-HOST-CONFIG-STORAGE	No	Cluster containing client cluster VMs

Permissions for CNS-DATASTORE role

Category	Permission
Datastore	Low level file operations

Permissions for CNS-SEARCH-AND-SPBM role

HTML Table

Category	Permission
CNS	Searchable
Profile-driven storage	Profile-driven storage view

Permissions for CNS-VM role

HTML Table

Category	Permission
Virtual machine	Change Configuration: Add existing disk Add or remove device Add new disk Extend virtual disk Remove disk

Permissions for CNS-HOST-CONFIG-STORAGE role

HTML Table

Category	Permission
Host	Configuration: Storage partition configuration

Example role creation commands

# Role for read, write, delete, and rename in datastore
govc role.create CNS-DATASTORE Datastore.FileManagement 

# Role for viewing host, cluster, volume, and VM information
govc role.create CNS-SEARCH-AND-SPBM Cns.Searchable StorageProfile.View

# Role to add/remove VM disks and non-disk devices
govc role.create CNS-VM VirtualMachine.Config.AddExistingDisk VirtualMachine.Config.AddRemoveDevice VirtualMachine.Config.AddNewDisk VirtualMachine.Config.DiskExtend VirtualMachine.Config.RemoveDisk

# Role for VMFS and iSCSI host configuration
govc role.create CNS-HOST-CONFIG-STORAGE Host.Config.Storage

Note! These roles let you split access in vSphere, granting permissions:

on a specific Datastore;
to manage VMs in a specific k8s folder;
to configure hosts in the required cluster.

Example commands for split access permissions

# Grant permissions on Datastore named Cluster01-vSAN
govc permissions.set -principal <username>@vsphere.local -propagate=false -role CNS-DATASTORE /Datacenter/datastore/Cluster01-vSAN

# Search information from root
govc permissions.set -principal <username>@vsphere.local -propagate=false -role CNS-SEARCH-AND-SPBM /

# Grant VM management permissions in k8s folder
govc permissions.set -principal <username>@vsphere.local -propagate=true  -role CNS-VM /Datacenter/vm/k8s/

# Grant host configuration permissions on Cluster01 and Datacenter
govc permissions.set -principal <username>@vsphere.local -propagate=false -role CNS-HOST-CONFIG-STORAGE /Datacenter /Datacenter/host/Cluster01

You can skip splitting permissions in vSphere. Create one combined role with the required permissions and assign it to your account.

Rights assignment scheme

Object	Role	Propagation (inheritance)	Comment
Datastore	SHTURVAL-CSI	No	Datastore for client cluster VM disks
vCenter	SHTURVAL-CSI	No	vCenter where client cluster VMs run
Folder	SHTURVAL-CSI	Yes	Folder containing client cluster VMs
Datacenter	SHTURVAL-CSI	No	Datacenter containing client cluster VMs
Cluster	SHTURVAL-CSI	No	Cluster containing client cluster VMs

Permissions for SHTURVAL-CSI role

HTML Table

Category	Permission
Datastore	Low level file operations
CNS	Searchable
Profile-driven storage	Profile-driven storage view
Host	Configuration: Storage partition configuration
Virtual machine	Change Configuration: Add existing disk Add or remove device Add new disk Extend virtual disk Remove disk

Example combined role creation command

govc role.create SHTURVAL-CSI Datastore.FileManagement Cns.Searchable StorageProfile.View VirtualMachine.Config.AddExistingDisk VirtualMachine.Config.AddRemoveDevice VirtualMachine.Config.AddNewDisk VirtualMachine.Config.DiskExtend VirtualMachine.Config.RemoveDisk Host.Config.Storage

Example command to grant permissions without splitting

govc permissions.set -principal <username>@vsphere.local -role SHTURVAL-CSI /

Изменено 2026-02-12 at 00:00

Service account requirements

Account and roles for vSphere CSI #

Account and roles for vSphere CSI