validate vmware user privileges

[rvanderp3]

The intent of this PR is to validate the privileges granted to the user assigned to OpenShift to interact with vCenter. The privilege list found in the OpenShift docs is used to build the target set of permissions.

What is being checked?

• datastore, datacenter, compute cluster, vCenter root folder, and vm folder

How is a user notified of a lack of privileges? When it is determined that an account holds inadequate privileges, an alert is raised and the discrete missing privileges are logged.

For the datastores, datacenter, vCenter root folder, and vm folder, the metric vsphere_cluster_check_errors[check=CheckAccountPermissions] will be set to 1.

For compute cluster privileges, vsphere_node_check_errors[check=CheckAccountPermissions] will be set to 1. This is due to the compute cluster not being readily available in a resource. The compute cluster is determined by checking the parent of individual VMs.

The vsphere-problem-detector logs will contain the missing privileges:

I0411 21:11:08.140614 1 vsphere_check.go:224] CheckAccountPermissions failed: missing privileges for datastore nvmepool: Datastore.AllocateSpace, Datastore.Browse, Datastore.FileManagement

How is it being tested?

• Unit tests verify the behavior of the checks for each of the specific privilege groups.
• CI in the IBM Cloud runs with restricted, but adequate, privileges. If this check fails an alert will be raised.

[elmiko]

this seems like a nice upgrade, +1

[rvanderp3]

example of failed check due to misconfigured permissions on the vsphere cluster:

I0928 17:58:28.895992       1 privileges.go:25] CheckUserPrivileges: *** Missing Privileges ***
vSphere object: vSphere vCenter Cluster
Host.Config.Storage, Resource.AssignVMToPool, VApp.AssignResourcePool, VApp.Import, VirtualMachine.Config.AddNewDisk

I0928 17:58:28.896865       1 vsphere_check.go:217] CheckUserPrivileges passed
I0928 17:58:29.096515       1 folder.go:100] CheckFolderPermissions: found 41 files in datastore nvmepool at path /

[rvanderp3]

/hold

resuming work on this PR. placing a hold for now.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[rvanderp3]

refactored to allow for unit testing and better integration with the project, work is still ongoing.

[rvanderp3]

/remove-lifecycle stale

[rvanderp3]

/hold cancel

[jsafrane]

/assign @gnufied

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-ci[bot]]

@rvanderp3: PR needs rebase.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.

[rvanderp3]

/hold

need to update with latest privilege set

[rvanderp3]

/remove-lifecycle stale

[rvanderp3]

/hold cancel

[rvanderp3]

/assign @gnufied cc: @jcpowermac

[openshift-ci[bot]]

@rvanderp3: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).

[gnufied]

/lgtm /approve

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gnufied, rvanderp3

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/vsphere-problem-detector/blob/master/OWNERS)~~ [gnufied] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[gnufied]

/label docs-approved /label px-approved

[Phaow]

/label qe-approved