Restrict user accounts to specific clusters/SVMs

[statdigger]

Hi,

we have a number of viewer accounts that only require Harvest information on specific SVMs on specific Netapp clusters. Is there any way to limit the access of each viewer account in this manner rather than seeing all clusters defined in NABox ?

We are using:
Alpine Linux
Harvest 23.08
NABox 3.3

[cgrinds]

hi @statdigger
Take a look at these and let us know if they meet your needs.

• https://github.com/NetApp/harvest/wiki/FAQ#multi-tenancy
• Harvest should add grafana import rewrite filtering for multi-tenant support #2061

[statdigger]

Many thanks for your reply cgrinds.

It sounds like multi-tenancy is a way to achieve it, although I confess I was rather hoping their was a filter in a config file somewhere that could restrict access on a per user basis.
I don't wish to limit what metrics are captured and visible to an admin user, just to limit a viewer account to only be able to select a specified ONTAP cluster and/or SVM from the dashboard dropdown menus, in doing hiding those that are not relevant to the viewers role.

[cgrinds]

hi @statdigger the Grafana import rewrite link was how another customer solved this. They created a set of Grafana users (viewer role) that are limited to a set of SVMs and then used the --svm-variable-regex command line argument to rewrite all the Harvest dashboards when they were imported via bin/harvest grafana import...

Doing it this way does not limit the captured metrics. All limits are via Grafana variables and creating user accounts that can not "escape" those variables.