[SOLVED] Allow user to create VMs, but only see and manage those created by itself

[Noah0302]

Hello guys,

I've been trying to find a better solution for my problem:
-Allow a user (test) to create VMs and manage those fully, but prevent user (test) from doing anything else, not even seeing if there are other VMs on the Host

I did this by moving all VMs to a pool, which user (test) is blocked from accessing, however this is a bit annoying, since every newly created VM has to be moved to this pool, in order for user (test) to not see it.

Is there a better way of doing this?

Thank you for reading!

 

[Matthias.]

Why not give the user permission only on a specific pool?

 

[Noah0302]

Ok so I think I figured it out, was confused before:

1. Create a User (test)
2. Create a Pool (test)
3. Give the user (test@pve) the Administrator role on the Pool (/pool/test) and Storage (/storage) he should be able to use
4. If the user wants to create a VM or CT, he just has to select his pool (test) when creating it, otherwise there will be a permission error

Screenshots below:

 

[Noah0302]

Why not give the user permission only on a specific pool?

Thank you, I thought I had to add NoAccess of "/" to the user "test", so this way to only way I found for the user to be able to create VMs.
I posted a reply above, with the steps I used.

 

[Matthias.]

Great! Please mark the thread as solved (edit it, there's a dropdown near the title) so others with the same problem can find it more easily.

 

[tasmandevil]

Thank you, I thought I had to add NoAccess of "/" to the user "test", so this way to only way I found for the user to be able to create VMs.
I posted a reply above, with the steps I used.

Thanks for your help, but I wanted to mention, that the storage is shared, so student can attach to his own VM other classmate's vm-storage.

 

[kellogs]

Ok so I think I figured it out, was confused before:

1. Create a User (test)
2. Create a Pool (test)
3. Give the user (test@pve) the Administrator role on the Pool (/pool/test) and Storage (/storage) he should be able to use
4. If the user wants to create a VM or CT, he just has to select his pool (test) when creating it, otherwise there will be a permission error

Screenshots below:

i am having the same issue and when i did the same and if i change to folder view -> storage -> volume -> vm disks that user is able to remove other VMs disk which is not under his pool!

i wonder if there is any better solution to this

 

[toodaysdemo]

This is great, I'm just curious how can I put the pool onto a seperate VLAN? I've checked pool, group, permission and roles but nothing that would force user1 to create and maanger their own VMs on the assigned VLAN