// Module included in the following assemblies for vSphere:
//
// * installing/installing_vsphere/ipi/ipi-vsphere-installation-reqs.adoc
// * installing/installing_vsphere/upi/upi-vsphere-installation-reqs.adoc

// Note: The ifndef statements add content to IPI documents
ifeval::["{context}" == "ipi-vsphere-installation-reqs"]
:ipi:
endif::[]
ifeval::["{context}" == "upi-vsphere-installation-reqs"]
:upi:
endif::[]

:_mod-docs-content-type: REFERENCE
[id="installation-vsphere-installer-infra-requirements_{context}"]
= vCenter requirements

ifndef::upi[]
Before you install an {product-title} cluster on your vCenter that uses infrastructure that the installation program provisions, you must prepare your environment.
endif::upi[]

ifdef::upi[]
Before you install an {product-title} cluster on your vCenter that uses infrastructure that you provided, you must prepare your environment.
endif::upi[]


[id="installation-vsphere-installer-infra-requirements-account_{context}"]
== Required vCenter account privileges

ifndef::upi[]
To install an {product-title} cluster in a vCenter, the installation program requires access to an account with privileges to read and create the required resources. Using an account that has global administrative privileges is the simplest way to access all of the necessary permissions.

If you cannot use an account with global administrative privileges, you must create roles to grant the privileges necessary for {product-title} cluster installation. Most of the privileges are always required. Some privileges are required only if you plan for the installation program to provision a folder to contain the {product-title} cluster on your vCenter instance, which is the default behavior. You must create or change vSphere roles for the specified objects to grant the required privileges.

The installation program requires an additional role to create a vSphere virtual machine folder.
endif::upi[]

ifdef::upi[]
To install an {product-title} cluster in a vCenter, your vSphere account must include privileges for reading and creating the required resources. Using an account that has global administrative privileges is the simplest way to access all of the necessary permissions.
endif::upi[]


.Roles and privileges required for installation in vSphere API
[%collapsible]
====
[cols="3a,3a,3a",options="header"]
|===
|vSphere object for role
|When required
|Required privileges in vSphere API

|vSphere vCenter
|Always
|
[%hardbreaks]
`Cns.Searchable`
`InventoryService.Tagging.AttachTag`
`InventoryService.Tagging.CreateCategory`
`InventoryService.Tagging.CreateTag`
`InventoryService.Tagging.DeleteCategory`
`InventoryService.Tagging.DeleteTag`
`InventoryService.Tagging.EditCategory`
`InventoryService.Tagging.EditTag`
`Sessions.ValidateSession`
`StorageProfile.Update`
`StorageProfile.View`

|vSphere vCenter Cluster
|If VMs need creation in the cluster root
|
[%hardbreaks]
`Host.Config.Storage`
`Resource.AssignVMToPool`
`VApp.AssignResourcePool`
`VApp.Import`
`VirtualMachine.Config.AddNewDisk`

|vSphere vCenter Resource Pool
|For a provided existing resource pool
|
[%hardbreaks]
`Resource.AssignVMToPool`
`VApp.AssignResourcePool`
`VApp.Import`
`VirtualMachine.Config.AddNewDisk`

|vSphere Datastore
|Always
|
[%hardbreaks]
`Datastore.AllocateSpace`
`Datastore.Browse`
`Datastore.FileManagement`
`InventoryService.Tagging.ObjectAttachable`

|vSphere Port Group
|Always
|`Network.Assign`

|Virtual Machine Folder
|Always
|
[%hardbreaks]
`InventoryService.Tagging.ObjectAttachable`
`Resource.AssignVMToPool`
`VApp.Import`
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddNewDisk`
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Config.AdvancedConfig`
`VirtualMachine.Config.Annotation`
`VirtualMachine.Config.CPUCount`
`VirtualMachine.Config.DiskExtend`
`VirtualMachine.Config.DiskLease`
`VirtualMachine.Config.EditDevice`
`VirtualMachine.Config.Memory`
`VirtualMachine.Config.RemoveDisk`
`VirtualMachine.Config.Rename`
`Host.Config.Storage`
`VirtualMachine.Config.ResetGuestInfo`
`VirtualMachine.Config.Resource`
`VirtualMachine.Config.Settings`
`VirtualMachine.Config.UpgradeVirtualHardware`
`VirtualMachine.Interact.GuestControl`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Interact.Reset`
`VirtualMachine.Inventory.Create`
`VirtualMachine.Inventory.CreateFromExisting`
`VirtualMachine.Inventory.Delete`
`VirtualMachine.Provisioning.Clone`
`VirtualMachine.Provisioning.MarkAsTemplate`
`VirtualMachine.Provisioning.DeployTemplate`

|vSphere vCenter data center
ifdef::ipi[]
|The installation program creates the virtual machine folder.
endif::ipi[]
ifdef::upi[]
|`VirtualMachine.Inventory.Create` and `VirtualMachine.Inventory.Delete` privileges are optional if your cluster does not use the Machine API. See the "Minimum permissions for the Machine API" table.
endif::upi[]
|
[%hardbreaks]
`InventoryService.Tagging.ObjectAttachable`
`Resource.AssignVMToPool`
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddNewDisk`
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Config.AdvancedConfig`
`VirtualMachine.Config.Annotation`
`VirtualMachine.Config.CPUCount`
`VirtualMachine.Config.DiskExtend`
`VirtualMachine.Config.DiskLease`
`VirtualMachine.Config.EditDevice`
`VirtualMachine.Config.Memory`
`VirtualMachine.Config.RemoveDisk`
`VirtualMachine.Config.Rename`
`VirtualMachine.Config.ResetGuestInfo`
`VirtualMachine.Config.Resource`
`VirtualMachine.Config.Settings`
`VirtualMachine.Config.UpgradeVirtualHardware`
`VirtualMachine.Interact.GuestControl`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Interact.Reset`
`VirtualMachine.Inventory.Create`
`VirtualMachine.Inventory.CreateFromExisting`
`VirtualMachine.Inventory.Delete`
`VirtualMachine.Provisioning.Clone`
`VirtualMachine.Provisioning.DeployTemplate`
`VirtualMachine.Provisioning.MarkAsTemplate`
`Folder.Create`
`Folder.Delete`
|===
====


.Roles and privileges required for installation in vCenter graphical user interface (GUI)
[%collapsible]
====
[cols="2a,3a,3a",options="header"]
|===
|vSphere object for role
|When required
|Required privileges in vCenter GUI

|vSphere vCenter
|Always
|
[%hardbreaks]
`Cns.Searchable`
`"vSphere Tagging"."Assign or Unassign vSphere Tag"`
`"vSphere Tagging"."Create vSphere Tag Category"`
`"vSphere Tagging"."Create vSphere Tag"`
`vSphere Tagging"."Delete vSphere Tag Category"`
`"vSphere Tagging"."Delete vSphere Tag"`
`"vSphere Tagging"."Edit vSphere Tag Category"`
`"vSphere Tagging"."Edit vSphere Tag"`
`Sessions."Validate session"`
`"VM storage policies"."Update VM storage policies"`
`"VM storage policies"."View VM storage policies"`

|vSphere vCenter Cluster
|For VMs creation in the cluster root
|
[%hardbreaks]
`Host.Configuration."Storage partition configuration"`
`Resource."Assign virtual machine to resource pool"`
`VApp."Assign resource pool"`
`VApp.Import`
`"Virtual machine"."Change Configuration"."Add new disk"`

|vSphere vCenter Resource Pool
|If providing an existing resource pool
|
[%hardbreaks]
`Host.Configuration."Storage partition configuration"`
`Resource."Assign virtual machine to resource pool"`
`VApp."Assign resource pool"`
`VApp.Import`
`"Virtual machine"."Change Configuration"."Add new disk"`

|vSphere Datastore
|Always
|
[%hardbreaks]
`Datastore."Allocate space"`
`Datastore."Browse datastore"`
`Datastore."Low level file operations"`
`"vSphere Tagging"."Assign or Unassign vSphere Tag on Object"`

|vSphere Port Group
|Always
|`Network."Assign network"`

|Virtual Machine Folder
|Always
|
[%hardbreaks]
`"vSphere Tagging"."Assign or Unassign vSphere Tag on Object"`
`Resource."Assign virtual machine to resource pool"`
`VApp.Import`
`"Virtual machine"."Change Configuration"."Add existing disk"`
`"Virtual machine"."Change Configuration"."Add new disk"`
`"Virtual machine"."Change Configuration"."Add or remove device"`
`"Virtual machine"."Change Configuration"."Advanced configuration"`
`"Virtual machine"."Change Configuration"."Set annotation"`
`"Virtual machine"."Change Configuration"."Change CPU count"`
`"Virtual machine"."Change Configuration"."Extend virtual disk"`
`"Virtual machine"."Change Configuration"."Acquire disk lease"`
`"Virtual machine"."Change Configuration"."Modify device settings"`
`"Virtual machine"."Change Configuration"."Change Memory"`
`"Virtual machine"."Change Configuration"."Remove disk"`
`"Virtual machine"."Change Configuration".Rename`
`"Virtual machine"."Change Configuration"."Reset guest information"`
`"Virtual machine"."Change Configuration"."Change resource"`
`"Virtual machine"."Change Configuration"."Change Settings"`
`"Virtual machine"."Change Configuration"."Upgrade virtual machine compatibility"`
`"Virtual machine".Interaction."Guest operating system management by VIX API"`
`"Virtual machine".Interaction."Power off"`
`"Virtual machine".Interaction."Power on"`
`"Virtual machine".Interaction.Reset`
`"Virtual machine"."Edit Inventory"."Create new"`
`"Virtual machine"."Edit Inventory"."Create from existing"`
`"Virtual machine"."Edit Inventory"."Remove"`
`"Virtual machine".Provisioning."Clone virtual machine"`
`"Virtual machine".Provisioning."Mark as template"`
`"Virtual machine".Provisioning."Deploy template"`

|vSphere vCenter data center
ifdef::ipi[]
|The installation program creates the virtual machine folder.
endif::ipi[]
ifdef::upi[]
|`VirtualMachine.Inventory.Create` and `VirtualMachine.Inventory.Delete` privileges are optional if your cluster does not use the Machine API.
endif::upi[]
|
[%hardbreaks]
`"vSphere Tagging"."Assign or Unassign vSphere Tag on Object"`
`Resource."Assign virtual machine to resource pool"`
`VApp.Import`
`"Virtual machine"."Change Configuration"."Add existing disk"`
`"Virtual machine"."Change Configuration"."Add new disk"`
`"Virtual machine"."Change Configuration"."Add or remove device"`
`"Virtual machine"."Change Configuration"."Advanced configuration"`
`"Virtual machine"."Change Configuration"."Set annotation"`
`"Virtual machine"."Change Configuration"."Change CPU count"`
`"Virtual machine"."Change Configuration"."Extend virtual disk"`
`"Virtual machine"."Change Configuration"."Acquire disk lease"`
`"Virtual machine"."Change Configuration"."Modify device settings"`
`"Virtual machine"."Change Configuration"."Change Memory"`
`"Virtual machine"."Change Configuration"."Remove disk"`
`"Virtual machine"."Change Configuration".Rename`
`"Virtual machine"."Change Configuration"."Reset guest information"`
`"Virtual machine"."Change Configuration"."Change resource"`
`"Virtual machine"."Change Configuration"."Change Settings"`
`"Virtual machine"."Change Configuration"."Upgrade virtual machine compatibility"`
`"Virtual machine".Interaction."Guest operating system management by VIX API"`
`"Virtual machine".Interaction."Power off"`
`"Virtual machine".Interaction."Power on"`
`"Virtual machine".Interaction.Reset`
`"Virtual machine"."Edit Inventory"."Create new"`
`"Virtual machine"."Edit Inventory"."Create from existing"`
`"Virtual machine"."Edit Inventory"."Remove"`
`"Virtual machine".Provisioning."Clone virtual machine"`
`"Virtual machine".Provisioning."Deploy template"`
`"Virtual machine".Provisioning."Mark as template"`
`Folder."Create folder"`
`Folder."Delete folder"`
|===
====


Additionally, the user requires some `ReadOnly` permissions, and some of the roles require permission to propagate the permissions to child objects. These settings vary depending on whether or not you install the cluster into an existing folder.

.Required permissions and propagation settings
[%collapsible]
====
[cols="3a,3a,3a,3a",options="header"]
|===
|vSphere object
|When required
|Propagate to children
|Permissions required

|vSphere vCenter
|Always
|False
|Listed required privileges

ifdef::upi[]
|vSphere vCenter data center
|Existing folder
|False
|`ReadOnly` permission
endif::upi[]

ifdef::ipi[]
.2+|vSphere vCenter data center
|Existing folder
|False
|`ReadOnly` permission

|Installation program creates the folder
|True
|Listed required privileges
endif::ipi[]

.2+|vSphere vCenter Cluster
|Existing resource pool
|False
|`ReadOnly` permission

|VMs in cluster root
|True
|Listed required privileges

|vSphere vCenter Datastore
|Always
|False
|Listed required privileges

|vSphere Switch
|Always
|False
|`ReadOnly` permission

|vSphere Port Group
|Always
|False
|Listed required privileges

|vSphere vCenter Virtual Machine Folder
|Existing folder
|True
|Listed required privileges

|vSphere vCenter Resource Pool
|Existing resource pool
|True
|Listed required privileges
|===
====

For more information about creating an account with only the required privileges, see link:https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-5372F580-5C23-4E9C-8A4E-EF1B4DD9033E.html[vSphere Permissions and User Management Tasks] in the vSphere documentation.


[id="installation-vsphere-installer-infra-minimum-requirements_{context}"]
== Minimum required vCenter account privileges

After you create a custom role and assign privileges to the role, you can create permissions by selecting specific vSphere objects. You can then assign the custom role to a user or group for each object.

Before you create permissions or request for the creation of permissions for a vSphere object, decide what minimum permissions apply to the vSphere object. By doing this task, you can ensure a basic interaction exists between a vSphere object and {product-title} architecture.

[IMPORTANT]
====
If you create a custom role and you do not assign privileges to it, the vSphere Server by default assigns a `Read Only` role to the custom role. Note that for the cloud provider API, the custom role only needs to inherit the privileges of the `Read Only` role.
====

Consider creating a custom role when an account with global administrative privileges does not meet your needs.

[IMPORTANT]
====
Red{nbsp}Hat does not support configuring an account without including the required privileges. Installing an {product-title} cluster in a vCenter is tested against a full list of privileges as described in the "Required vCenter account privileges" section. By adhering to the full list of privileges, you can reduce the possibility of unexpected behaviors that might occur when creating a custom role with a restricted set of privileges.
====

The following tables specify how the required vCenter account privileges provided earlier in this document are relevant to different aspects of {product-title} architecture.

ifndef::upi[]
[id="installation-vsphere-minimum-permissions-ipi_{context}"]
.Minimum permissions on installer-provisioned infrastructure
[%collapsible]
====
[cols="4a,4a,3a",options="header"]
|===
|vSphere object for role
|When required
|Required privileges

|vSphere vCenter
|Always
|
[%hardbreaks]
`Cns.Searchable`
`InventoryService.Tagging.AttachTag`
`InventoryService.Tagging.CreateCategory`
`InventoryService.Tagging.CreateTag`
`InventoryService.Tagging.DeleteCategory`
`InventoryService.Tagging.DeleteTag`
`InventoryService.Tagging.EditCategory`
`InventoryService.Tagging.EditTag`
`Sessions.ValidateSession`
`StorageProfile.Update`
`StorageProfile.View`

|vSphere vCenter Cluster
|If you intend to create VMs in the cluster root
|
[%hardbreaks]
`Host.Config.Storage`
`Resource.AssignVMToPool`
`VApp.AssignResourcePool`
`VApp.Import`
`VirtualMachine.Config.AddNewDisk`

|vSphere vCenter Resource Pool
|If you included an existing resource pool in the `install-config.yaml` file
|
[%hardbreaks]

`Host.Config.Storage`
`Resource.AssignVMToPool`
`VApp.AssignResourcePool`
`VApp.Import`minimum`

|vSphere Datastore
|If you referenced a datastore in the `install-config.yaml` file
|
[%hardbreaks]

`Datastore.Browse`
`Datastore.FileManagement`
`InventoryService.Tagging.ObjectAttachable`

|vSphere Port Group
|Always
|
[%hardbreaks]
`Network.Assign`

|Virtual Machine Folder
|Always
|
[%hardbreaks]
`InventoryService.Tagging.ObjectAttachable`
`Resource.AssignVMToPool`
`VApp.Import`
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddNewDisk`
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Config.AdvancedConfig`
`VirtualMachine.Config.Annotation`
`VirtualMachine.Config.CPUCount`
`VirtualMachine.Config.DiskExtend`
`VirtualMachine.Config.DiskLease`
`VirtualMachine.Config.EditDevice`
`VirtualMachine.Config.Memory`
`VirtualMachine.Config.RemoveDisk`
`VirtualMachine.Config.Rename`
`VirtualMachine.Config.ResetGuestInfo`
`VirtualMachine.Config.Resource`
`VirtualMachine.Config.Settings`
`VirtualMachine.Config.UpgradeVirtualHardware`
`VirtualMachine.Interact.GuestControl`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Interact.Reset`
`VirtualMachine.Inventory.Create`
`VirtualMachine.Inventory.CreateFromExisting`
`VirtualMachine.Inventory.Delete`
`VirtualMachine.Provisioning.Clone`
`VirtualMachine.Provisioning.MarkAsTemplate`
`VirtualMachine.Provisioning.DeployTemplate`

|vSphere vCenter data center
|If the virtual machine folder does not already exist, the installation program creates the virtual machine folder. If your cluster does use the Machine API and you want to set the minimum set of permissions for the API, see the "Minimum permissions for the Machine API" table.
|
[%hardbreaks]
`Folder.Create`
`Folder.Delete`
`InventoryService.Tagging.ObjectAttachable`
`Resource.AssignVMToPool`
`VApp.Import`
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddNewDisk`
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Config.AdvancedConfig`
`VirtualMachine.Config.Annotation`
`VirtualMachine.Config.CPUCount`
`VirtualMachine.Config.DiskExtend`
`VirtualMachine.Config.DiskLease`
`VirtualMachine.Config.EditDevice`
`VirtualMachine.Config.Memory`
`VirtualMachine.Config.RemoveDisk`
`VirtualMachine.Config.Rename`
`VirtualMachine.Config.ResetGuestInfo`
`VirtualMachine.Config.Resource`
`VirtualMachine.Config.Settings`
`VirtualMachine.Config.UpgradeVirtualHardware`
`VirtualMachine.Interact.GuestControl`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Interact.Reset`
`VirtualMachine.Inventory.Create`
`VirtualMachine.Inventory.CreateFromExisting`
`VirtualMachine.Inventory.Delete`
`VirtualMachine.Provisioning.Clone`
`VirtualMachine.Provisioning.DeployTemplate`
`VirtualMachine.Provisioning.MarkAsTemplate`
|===
====
endif::upi[]

[id="post-installation-vsphere-minimum-permissions_{context}"]
.Minimum permissions for postinstallation management of components
[%collapsible]
====
[cols="4a,4a,3a",options="header"]
|===
|vSphere object for role
|When required
|Required privileges

|vSphere vCenter
|Always
|
[%hardbreaks]
`Cns.Searchable`
`InventoryService.Tagging.AttachTag`
`InventoryService.Tagging.CreateCategory`
`InventoryService.Tagging.CreateTag`
`InventoryService.Tagging.DeleteCategory`
`InventoryService.Tagging.DeleteTag`
`InventoryService.Tagging.EditCategory`
`InventoryService.Tagging.EditTag`
`Sessions.ValidateSession`
`StorageProfile.Update`
`StorageProfile.View`

|vSphere vCenter Cluster
|If you intend to create VMs in the cluster root
|
[%hardbreaks]
`Host.Config.Storage`
`Resource.AssignVMToPool`

|vSphere vCenter Resource Pool
|If you included an existing resource pool in the `install-config.yaml` file
|
[%hardbreaks]
`Host.Config.Storage`

|vSphere Datastore
|Always
|
[%hardbreaks]
`Datastore.AllocateSpace`
`Datastore.Browse`
`Datastore.FileManagement`
`InventoryService.Tagging.ObjectAttachable`

|vSphere Port Group
|Always
|
[%hardbreaks]
`Network.Assign`

|Virtual Machine Folder
|Always
|
[%hardbreaks]
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Config.AdvancedConfig`
`VirtualMachine.Config.Annotation`
`VirtualMachine.Config.CPUCount`
`VirtualMachine.Config.DiskExtend`
`VirtualMachine.Config.Memory`
`VirtualMachine.Config.Settings`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Inventory.CreateFromExisting`
`VirtualMachine.Inventory.Delete`
`VirtualMachine.Provisioning.Clone`
`VirtualMachine.Provisioning.DeployTemplate`

|vSphere vCenter data center
ifdef::ipi[]
|If the virtual machine folder does not already exist, the installation program creates the virtual machine folder.
endif::ipi[]
ifdef::upi[]
|`VirtualMachine.Inventory.Create` and `VirtualMachine.Inventory.Delete` privileges are optional if your cluster does not use the Machine API. If your cluster does use the Machine API and you want to set the minimum set of permissions for the API, see the "Minimum permissions for the Machine API" table.
endif::upi[]
|
[%hardbreaks]
`Resource.AssignVMToPool`
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Provisioning.DeployTemplate`
|===
====

[id="installation-vsphere-minimum-permissions-storage_{context}"]
.Minimum permissions for the storage components
[%collapsible]
====
[cols="4a,4a,3a",options="header"]
|===
|vSphere object for role
|When required
|Required privileges

|vSphere vCenter
|Always
|
[%hardbreaks]
`Cns.Searchable`
`InventoryService.Tagging.CreateCategory`
`InventoryService.Tagging.CreateTag`
`InventoryService.Tagging.EditCategory`
`InventoryService.Tagging.EditTag`
`StorageProfile.Update`
`StorageProfile.View`

|vSphere vCenter Cluster
|If you intend to create VMs in the cluster root
|
[%hardbreaks]
`Host.Config.Storage`

|vSphere vCenter Resource Pool
|If you included an existing resource pool in the `install-config.yaml` file
|
[%hardbreaks]
`Host.Config.Storage`

|vSphere Datastore
|Always
|
[%hardbreaks]
`Datastore.Browse`
`Datastore.FileManagement`
`InventoryService.Tagging.ObjectAttachable`

|vSphere Port Group
|Always
|
[%hardbreaks]
`Read Only`

|Virtual Machine Folder
|Always
|
[%hardbreaks]
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddRemoveDevice`

|vSphere vCenter data center
ifdef::ipi[]
|If the virtual machine folder does not already exist, the installation program creates the virtual machine folder.
endif::ipi[]
ifdef::upi[]
|`VirtualMachine.Inventory.Create` and `VirtualMachine.Inventory.Delete` privileges are optional if your cluster does not use the Machine API. If your cluster does use the Machine API and you want to set the minimum set of permissions for the API, see the "Minimum permissions for the Machine API" table.
endif::upi[]
|
[%hardbreaks]
`VirtualMachine.Config.AddExistingDisk`
`VirtualMachine.Config.AddRemoveDevice`
|===
====

[id="post-installation-vsphere-minimum-machine-api_{context}"]
.Minimum permissions for the Machine API
[%collapsible]
====
[cols="4a,4a,3a",options="header"]
|===
|vSphere object for role
|When required
|Required privileges

|vSphere vCenter
|Always
|
[%hardbreaks]
`InventoryService.Tagging.AttachTag`
`InventoryService.Tagging.CreateCategory`
`InventoryService.Tagging.CreateTag`
`InventoryService.Tagging.DeleteCategory`
`InventoryService.Tagging.DeleteTag`
`InventoryService.Tagging.EditCategory`
`InventoryService.Tagging.EditTag`
`Sessions.ValidateSession`
`StorageProfile.Update`
`StorageProfile.View`

|vSphere vCenter Cluster
|If you intend to create VMs in the cluster root
|
[%hardbreaks]
`Resource.AssignVMToPool`

|vSphere vCenter Resource Pool
|If you included an existing resource pool in the `install-config.yaml` file
|
[%hardbreaks]
`Read Only`

|vSphere Datastore
|Always
|
[%hardbreaks]
`Datastore.AllocateSpace`
`Datastore.Browse`

|vSphere Port Group
|Always
|
[%hardbreaks]
`Network.Assign`

|Virtual Machine Folder
|Always
|
[%hardbreaks]
`VirtualMachine.Config.AddRemoveDevice`
`VirtualMachine.Config.AdvancedConfig`
`VirtualMachine.Config.Annotation`
`VirtualMachine.Config.CPUCount`
`VirtualMachine.Config.DiskExtend`
`VirtualMachine.Config.Memory`
`VirtualMachine.Config.Settings`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Inventory.CreateFromExisting`
`VirtualMachine.Inventory.Delete`
`VirtualMachine.Provisioning.Clone`
`VirtualMachine.Provisioning.DeployTemplate`

|vSphere vCenter data center
ifdef::ipi[]
|If the virtual machine folder does not already exist, the installation program creates the virtual machine folder.
endif::ipi[]
ifdef::upi[]
|`VirtualMachine.Inventory.Create` and `VirtualMachine.Inventory.Delete` privileges are optional if your cluster does not use the Machine API.
endif::upi[]
|
[%hardbreaks]
`Resource.AssignVMToPool`
`VirtualMachine.Interact.PowerOff`
`VirtualMachine.Interact.PowerOn`
`VirtualMachine.Provisioning.DeployTemplate`
|===
====


[id="installation-vsphere-installer-infra-requirements-vmotion_{context}"]
== Using {product-title} with vMotion

If you intend on using vMotion in your vSphere environment, consider the following before installing an {product-title} cluster.

* Using Storage vMotion can cause issues and is not supported.
* Using VMware compute vMotion to migrate the workloads for both {product-title} compute machines and control plane machines is generally supported, where _generally_ implies that you meet all VMware best practices for vMotion.
+
--
To help ensure the uptime of your compute and control plane nodes, ensure that you follow the VMware best practices for vMotion, and use VMware anti-affinity rules to improve the availability of {product-title} during maintenance or hardware issues.

For more information about vMotion and anti-affinity rules, see the VMware vSphere documentation for  link:https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vcenterhost.doc/GUID-3B41119A-1276-404B-8BFB-A32409052449.html[vMotion networking requirements] and link:https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.resmgmt.doc/GUID-FBE46165-065C-48C2-B775-7ADA87FF9A20.html[VM anti-affinity rules].
--
* If you are using {vmw-full} volumes in your pods, migrating a VM across datastores, either manually or through Storage vMotion, causes invalid references within {product-title} persistent volume (PV) objects that can result in data loss.
* {product-title} does not support selective migration of virtual machine disks (VMDKs) across datastores, using datastore clusters for VM provisioning or for dynamic or static provisioning of PVs, or using a datastore that is part of a datastore cluster for dynamic or static provisioning of PVs.
+
[IMPORTANT]
====
You can specify the path of any datastore that exists in a datastore cluster. By default, Storage Distributed Resource Scheduler (SDRS), which uses Storage vMotion, is automatically enabled for a datastore cluster. Red Hat does not support Storage vMotion, so you must disable SDRS to avoid data loss issues for your {product-title} cluster.
If you must specify VMs across many datastores, use a `datastore` object to specify a failure domain in your cluster's `install-config.yaml` configuration file. For more information, see "VMware vSphere region and zone enablement".
====


[id="installation-vsphere-installer-infra-requirements-resources_{context}"]
== Cluster resources

ifndef::upi[]
When you deploy an {product-title} cluster that uses installer-provisioned infrastructure, the installation program must be able to create several resources in your vCenter instance.

A standard {product-title} installation creates the following vCenter resources:
endif::upi[]

ifdef::upi[]
When you deploy an {product-title} cluster that uses infrastructure that you provided, you must create the following resources in your vCenter instance:
endif::upi[]

* 1 Folder
* 1 Tag category
* 1 Tag
* Virtual machines:
** 1 template
** 1 temporary bootstrap node
** 3 control plane nodes
** 3 compute machines

Although these resources use 856 GB of storage, the bootstrap node gets deleted during the cluster installation process. At a minimum, a standard cluster requires 800 GB of storage.

If you deploy more compute machines, the {product-title} cluster will use more storage.


[id="installation-vsphere-installer-infra-requirements-limits_{context}"]
== Cluster limits

Available resources vary between clusters. A limit exists for the number of possible clusters within vCenter, primarily by available storage space and any limitations on the number of required resources. Be sure to consider both limitations to the vCenter resources that the cluster creates and the resources that you require to deploy a cluster, such as IP addresses and networks.


[id="installation-vsphere-installer-infra-requirements-networking_{context}"]
== Networking requirements

You can use Dynamic Host Configuration Protocol (DHCP) for the network and configure the DHCP server to set persistent IP addresses to machines in your cluster. In the DHCP lease, you must configure the DHCP to use the default gateway.

[NOTE]
====
You do not need to use the DHCP for the network if you want to provision nodes with static IP addresses.
====

ifdef::upi[]
If you specify nodes or groups of nodes on different VLANs for a cluster that you want to install on user-provisioned infrastructure, you must ensure that machines in your cluster meet the requirements outlined in the "Network connectivity requirements" section of the _Networking requirements for user-provisioned infrastructure_ document.
endif::upi[]

If you are installing to a restricted environment, the VM in your restricted network must have access to vCenter so that it can provision and manage nodes, persistent volume claims (PVCs), and other resources.

[NOTE]
====
Ensure that each {product-title} node in the cluster has access to a Network Time Protocol (NTP) server that is discoverable by DHCP. Installation is possible without an NTP server. However, asynchronous server clocks can cause errors, which the NTP server prevents.
====

Additionally, you must create the following networking resources before you install the {product-title} cluster:

ifndef::upi[]

[id="installation-vsphere-installer-infra-requirements-_{context}"]
=== Required IP addresses
For a network that uses DHCP, an installer-provisioned vSphere installation requires two static IP addresses:

* The **API** address for accessing the cluster API.
* The **Ingress** address for cluster ingress traffic.

You must give these IP addresses to the installation program when you install the {product-title} cluster.
endif::upi[]


[id="installation-vsphere-installer-infra-requirements-dns-records_{context}"]
=== DNS records
You must create DNS records for two static IP addresses in the appropriate DNS server for the vCenter instance that hosts your {product-title} cluster. In each record, `<cluster_name>` is the cluster name and `<base_domain>` is the cluster base domain that you specify when you install the cluster. A complete DNS record takes the form: `<component>.<cluster_name>.<base_domain>.`.

.Required DNS records
[cols="1a,5a,3a",options="header"]
|===

|Component
|Record
|Description

|API VIP
|`api.<cluster_name>.<base_domain>.`
|This DNS A/AAAA or CNAME (Canonical Name) record must point to the load balancer for the control plane machines. This record must be resolvable by both clients external to the cluster and from all the nodes within the cluster.

|Ingress VIP
|`*.apps.<cluster_name>.<base_domain>.`
|A wildcard DNS A/AAAA or CNAME record that points to the load balancer that targets the machines that run the Ingress router pods, which are the worker nodes by default. This record must be resolvable by both clients external to the cluster and from all the nodes within the cluster.
|===

ifeval::["{context}" == "ipi-vsphere-installation-reqs"]
:!ipi:
endif::[]
ifeval::["{context}" == "upi-vsphere-installation-reqs"]
:!upi:
endif::[]
