Skip to content

Commit

Permalink
fix: update custom role privileges (#340)
Browse files Browse the repository at this point in the history 
Adds missing privileges to `README.md` configuration section and the Terraform example for a custom vSphere role.

- `Cryptographer.Access` required for `packer_cache` upload.
- `Cryptographer.Encrypt` required for vTPM.

Signed-off-by: Ryan Johnson <johnsonryan@vmware.com>
  • Loading branch information
@tenthirtyam
tenthirtyam committed Nov 8, 2022
1 parent f176918 commit 0c2bc43
Show file tree
Hide file tree
Showing 2 changed files with 37 additions and 33 deletions.
68 changes: 35 additions & 33 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -376,39 +376,41 @@ The files are distributed in the following directories.

Create a custom vSphere role with the required privileges to integrate HashiCorp Packer with VMware vSphere. A service account can be added to the role to ensure that Packer has least privilege access to the infrastructure. Clone the default **Read-Only** vSphere role and add the following privileges:

| Category | Privilege | Reference |
| --------------- | --------------------------------------------------- | -------------------------------------------------- |
| Content Library | Add library item | `ContentLibrary.AddLibraryItem` |
| ... | Update Library Item | `ContentLibrary.UpdateLibraryItem` |
| Datastore | Allocate space | `Datastore.AllocateSpace` |
| ... | Browse datastore | `Datastore.Browse` |
| ... | Low level file operations | `Datastore.FileManagement` |
| Host | Configuration > System Management | `Host.Config.SystemManagement` |
| Network | Assign network | `Network.Assign` |
| Resource | Assign virtual machine to resource pool | `Resource.AssignVMToPool` |
| vApp | Export | `vApp.Export` |
| Virtual Machine | Configuration > Add new disk | `VirtualMachine.Config.AddNewDisk` |
| ... | Configuration > Add or remove device | `VirtualMachine.Config.AddRemoveDevice` |
| ... | Configuration > Advanced configuration | `VirtualMachine.Config.AdvancedConfig` |
| ... | Configuration > Change CPU count | `VirtualMachine.Config.CPUCount` |
| ... | Configuration > Change memory | `VirtualMachine.Config.Memory` |
| ... | Configuration > Change settings | `VirtualMachine.Config.Settings` |
| ... | Configuration > Change Resource | `VirtualMachine.Config.Resource` |
| ... | Configuration > Modify device settings | `VirtualMachine.Config.EditDevice` |
| ... | Configuration > Set annotation | `VirtualMachine.Config.Annotation` |
| ... | Edit Inventory > Create from existing | `VirtualMachine.Inventory.CreateFromExisting` |
| ... | Edit Inventory > Create new | `VirtualMachine.Inventory.Create` |
| ... | Edit Inventory > Remove | `VirtualMachine.Inventory.Delete` |
| ... | Interaction > Configure CD media | `VirtualMachine.Interact.SetCDMedia` |
| ... | Interaction > Configure floppy media | `VirtualMachine.Interact.SetFloppyMedia` |
| ... | Interaction > Connect devices | `VirtualMachine.Interact.DeviceConnection` |
| ... | Interaction > Inject USB HID scan codes | `VirtualMachine.Interact.PutUsbScanCodes` |
| ... | Interaction > Power off | `VirtualMachine.Interact.PowerOff` |
| ... | Interaction > Power on | `VirtualMachine.Interact.PowerOn` |
| ... | Provisioning > Create template from virtual machine | `VirtualMachine.Provisioning.CreateTemplateFromVM` |
| ... | Provisioning > Mark as template | `VirtualMachine.Provisioning.MarkAsTemplate` |
| ... | Provisioning > Mark as virtual machine | `VirtualMachine.Provisioning.MarkAsVM` |
| ... | State > Create snapshot | `VirtualMachine.State.CreateSnapshot` |
| Category | Privilege | Reference |
| --------------- | --------------------------------------------------- | -------------------------------------------------- |
| Content Library | Add library item | `ContentLibrary.AddLibraryItem` |
| ... | Update Library Item | `ContentLibrary.UpdateLibraryItem` |
| Cryptographic Operations | Direct Access (Required for `packer_cache` upload.) | `Cryptographer.Access` |
| ... | Encrypt (Required for vTPM.) | `Cryptographer.Encrypt` |
| Datastore | Allocate space | `Datastore.AllocateSpace` |
| ... | Browse datastore | `Datastore.Browse` |
| ... | Low level file operations | `Datastore.FileManagement` |
| Host | Configuration > System Management | `Host.Config.SystemManagement` |
| Network | Assign network | `Network.Assign` |
| Resource | Assign virtual machine to resource pool | `Resource.AssignVMToPool` |
| vApp | Export | `vApp.Export` |
| Virtual Machine | Configuration > Add new disk | `VirtualMachine.Config.AddNewDisk` |
| ... | Configuration > Add or remove device | `VirtualMachine.Config.AddRemoveDevice` |
| ... | Configuration > Advanced configuration | `VirtualMachine.Config.AdvancedConfig` |
| ... | Configuration > Change CPU count | `VirtualMachine.Config.CPUCount` |
| ... | Configuration > Change memory | `VirtualMachine.Config.Memory` |
| ... | Configuration > Change settings | `VirtualMachine.Config.Settings` |
| ... | Configuration > Change Resource | `VirtualMachine.Config.Resource` |
| ... | Configuration > Modify device settings | `VirtualMachine.Config.EditDevice` |
| ... | Configuration > Set annotation | `VirtualMachine.Config.Annotation` |
| ... | Edit Inventory > Create from existing | `VirtualMachine.Inventory.CreateFromExisting` |
| ... | Edit Inventory > Create new | `VirtualMachine.Inventory.Create` |
| ... | Edit Inventory > Remove | `VirtualMachine.Inventory.Delete` |
| ... | Interaction > Configure CD media | `VirtualMachine.Interact.SetCDMedia` |
| ... | Interaction > Configure floppy media | `VirtualMachine.Interact.SetFloppyMedia` |
| ... | Interaction > Connect devices | `VirtualMachine.Interact.DeviceConnection` |
| ... | Interaction > Inject USB HID scan codes | `VirtualMachine.Interact.PutUsbScanCodes` |
| ... | Interaction > Power off | `VirtualMachine.Interact.PowerOff` |
| ... | Interaction > Power on | `VirtualMachine.Interact.PowerOn` |
| ... | Provisioning > Create template from virtual machine | `VirtualMachine.Provisioning.CreateTemplateFromVM` |
| ... | Provisioning > Mark as template | `VirtualMachine.Provisioning.MarkAsTemplate` |
| ... | Provisioning > Mark as virtual machine | `VirtualMachine.Provisioning.MarkAsVM` |
| ... | State > Create snapshot | `VirtualMachine.State.CreateSnapshot` |

If you would like to automate the creation of the custom vSphere role, a Terraform example is included in the project.

Expand Down
2 changes: 2 additions & 0 deletions terraform/vsphere-role/terraform.tfvars.example
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ packer_vsphere_privileges = [
"System.View",
"ContentLibrary.AddLibraryItem",
"ContentLibrary.UpdateLibraryItem",
"Cryptographer.Access",
"Cryptographer.Encrypt",
"Datastore.AllocateSpace",
"Datastore.Browse",
"Datastore.FileManagement",
Expand Down

0 comments on commit 0c2bc43

Please sign in to comment.