Per-User Access and Quotas in ManageIQ

[Petikuu]

Hi guys,

We are using ManageIQ with AD authentication and need to ensure that students can only see their own instances. Currently, we can restrict access per project group, but all members of the group see all project instances.

Our requirements:
Per-user access: Each student should see only their own instances, not other students’ instances.
Quotas: Each student should have a quota, ideally with a central quota for a course/project and possible sub-quotas per student.
Structure simplicity: We have courses (e.g., SOS) and engineering projects. Students should only see their own environments or environments of a small assigned group (2 people max).

Is there a way to configure per-user tenants or policies? If not, can you recommend an alternative structure so students only see their own instances without complex administration?

Thank you

Best regards, Peter

[Fryguy]

We don't have per-user tenant policies nor quotas, but we do have user-ownership of resources. You should be able to configure group-level quota, but still set the owner of a VM to a specific user. Then using RBAC, you can set the group to only be able to see user-owned resources.

[agrare]

Hey yeah there is a lot going on in this thread so if we can open separate issues on what specifically you're seeing that would be really helpful.

[dhamo-ror]

Not expecting anything different from this thread, Adam. Based on the points already mentioned, the expectation is the same for both user access and utilization. For utilization, I got the same output as mentioned.

[agrare]

@dhamo-ror you mentioned something about metrics and gnocchi not working as expected which sounds very different from user access and quotas. Maybe I misunderstood though.

[agrare]

Based on the original question, it sounds like @Fryguy's https://github.com/orgs/ManageIQ/discussions/23629#discussioncomment-14701254 is the answer. Anything else should be its own issue IMO

[dhamo-ror]

Yes Adam, I faced issues in gnnochi for metrics, I'll create a new issue for that