Permissions problem with vSphere 6.5 - "Cluster does not contain any hosts"

[unsichtbare]

In vSphere 6.0 and prior, we have a Role created based on the Veeam Granular Permissions for vSphere. We apply this Role to a specific user/group at the Datacenter level without propagation, and we apply it to the specific user/group Resource Pool created for that OU.

• In vSphere 6.0 and prior this works beautifully and allows Veeam to function, plus users of the OU can create new VMs and manage existing VMs in their and only their Resource Pool.

In testing vSphere 6.5, applying the Role to the user/group at the Datacenter without propagation, and at the Resource Pool, I get a message "Cluster does not contain any hosts" when trying to create a new VM! Just to eliminate speculation about the Role itself, I get the same error when the Administrator Role is applied to the user/group at the Datacenter without propagation and at the Resource Pool!

This is serious, because it basically prevents us moving forward with plans to migrate to 6.5! All of our OUs are separated by Resource Pools that have users assigned to them (which works perfectly in 6.0) and we will not meet our own SSAE16 or ISO 27001 standards if we can not make this work!

Any Ideas?

[unsichtbare]

So in comparing this to a 6.0 Cluster - this may be a problem with DRS.

The message "Cluster does not contain any hosts" what you get in 6.0 when DRS is set to manual or partially automated.

Just speculating, but some of the new DRS controls available in 6.5 may not properly integrate with the rest of the platform when set to "fully automated"

I plan on opening a case with VMware next week - but I dread the multitudes of flow-chart readers I will have to speak with before I get to someone that actually knows the product.

[hennigm]

Hi

We have the same Setup - Role on Datacenter without propagation and on the Ressorcepool - and get the message "Cluster does not contain Hosts.".

We had to give "Read" permission on at least one Host of the Cluster for this to be fixed. You could also set this on the Cluster itself and propagate but would consequently see all Hosts and Ressourcepools of other users/groups.

Hope this helps.

Kind regards.

Martin

[unsichtbare]

Thanks,

So part of the problem is that we (by our own SSAE statement) can not expose the hosts (hosts = "Infrastructure Resource") to our OUs.

This seems like an arbitrary problem, but not exposing Infrastructure to consumers is one of the fundamental tenants of Private Cloud Computing. Basically, if I can't make this work without exposing the hosts, I can't qualify vSphere 6.5 for our environment!

From NIST Definition of Cloud Computing:

"The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities"

[umrubi1]

Same here .... latest version of 6.5 

[tdye]

Did you ever get to the bottom of the permissions issue with v6.5?  I've encountered the same issue (vCenter v6.5.0, build #4602587), but I ended up granting the group 'read-only' permissions to one of the hosts in the cluster without propagation.  While this did work, I would love to know if VMware support 'fixed' this for you.

[rmon1234]

Anyone have a workaround for this in 6.5? I've got a lab environment used for Computer Science Students. I really don't want to give them read permissions on the host. The permission worked great on 6.0.

[cstorms1234]

Same issues - this has ruined a big piece of our app development teams progress as we cant add the Read Host permissions like others have said.

[DanielLuebbe]

Ran into the same issue here..

As the last post is some month old - does anyone found a more suitable solution to this other than exposing server(s) to the user groups assigned to these specific Resource Pools?

Any luck with vmware support on this?

Thanks for your updates,

Daniel