At the Permissions setting, add the DevOps group and assign the “Editor” permission. This is the recommended way to grant the DevOps team permissions to a vSphere Namespace in a VMware Cloud Foundation (VCF) developer-ready workload domain while following the principle of least privilege access. According to the VMware Cloud Foundation documentation1, the Editor permission allows users to create, modify, and delete objects within a vSphere Namespace, such as vSphere Pods, Tanzu Kubernetes clusters, and stand-alone VMs. The Editor permission also allows users to view and manage storage policies, VM classes, and content libraries for the namespace1
B. At the Global Permissions setting, add the DevOps group and assign the vSphere Kubernetes Manager role is not a correct option, because it will grant more privileges than necessary to the DevOps team. The vSphere Kubernetes Manager role is a global role that allows users to manage all aspects of vSphere with Tanzu, such as enabling Workload Management on clusters, creating and configuring vSphere Namespaces, and managing storage policies and VM classes. This role should be assigned only to vSphere administrators who are responsible for configuring and maintaining the VCF developer-ready workload domain1
C. At the Global Permissions setting, add the DevOps group and assign the SupervisorService Cluster Operator role is not a correct option, because it will also grant more privileges than necessary to the DevOps team. The SupervisorService Cluster Operator role is a global role that allows users to manage all aspects of Supervisor Services on clusters, such as creating and configuring Supervisor Service namespaces, managing service accounts and roles, and deploying service instances. This role should be assigned only to vSphere administrators who are responsible for enabling and managing Supervisor Services on VCF developer-ready workload domains1
D. At the Permissions setting, add the DevOps group and assign the “Can edit” permission is not a correct option, because there is no such permission in vSphere with Tanzu. The available permissions for vSphere Namespaces are Viewer, Editor, and Admin. The Viewer permission allows users to view objects within a vSphere Namespace, but not create or modify them. The Admin permission allows users to perform all actions within a vSphere Namespace, as well as manage permissions for other users or groups1
References: 1: Configure vSphere Namespace Permissions for vCenter Single Sign-On Users or Groups - VMware Docs
Submit