Add support for Global Permissions

[stobias123]

Description

Would love to be able to create roles, edit permissions, etc in vsphere just like I can in IAM.

Potential Terraform Configuration

resource "vsphere_role_attachment" {
     role = "Read-Only"
     group = "foobar group"
}

resource "vsphere_user" {
    username = "ansible-inventory@vsphere.local"
}

resource "vsphere_role_attachment" {
     role = "Read-Only"
     user = "ansible-inventory@vsphere.local"
}

resource "vsphere_role" {
    name = "foobar_role"
    permissions = {
        compute = ["Create and Delete Compute Policy"]
        global = [
          "Set custom attribute",
          "Settings"
        ]
    }
}

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[tenthirtyam]

Addressed in #1144; however, there are open issues on the implementation and an open enhancement for global permissions.

[danbarr]

Besides import, I'd also love to see the "description" property added to the role resource.

[tenthirtyam]

@danbarr Since creation of roles is an existing resource, I suggest filing and enhancements issue for adding the description the resource's schema.

Ryan

[tenthirtyam]

Correction, @danbarr. A description does not exist in the schema but label for display does. The docs/examples do not reference this. I'll PR this for you.

https://github.com/hashicorp/terraform-provider-vsphere/blob/c1f0d1ac4244d034f9116fee1e36e7d50b14aa2c/vsphere/resource_vsphere_role.go#L18-L37

Ryan

[danbarr]

@tenthirtyam label is a computed attribute, so I can't set it in a resource definition. For comparison, the vsphere_role data source does have description in its schema:
https://github.com/hashicorp/terraform-provider-vsphere/blob/c1f0d1ac4244d034f9116fee1e36e7d50b14aa2c/vsphere/data_source_vsphere_role.go#L15-L28

I can submit a separate enhancement for this, I was just following the precedent of your request #1231 being redirected back here.

[tenthirtyam]

Doh, I stand corrected re: the label. :)

Taking a look at the implementation it doesn't seem possible to pass the description (summary) to the resource since AuthorizationManager.AddRole in vmware/govomi does not support it. Might need some more digging.

https://github.com/vmware/govmomi/blob/bb0307eb84ae981cfca7fc8d680821a2c2be3c6d/object/authorization_manager.go#L138-L143

https://github.com/hashicorp/terraform-provider-vsphere/blob/2f53f7a557185a49b97313de823d663935d089de/vsphere/resource_vsphere_role.go#L48-L64